Description
WordPress Events Manager插件的/wp-admin/admin-ajax.php接口存在SQL时间盲注漏洞，攻击者可通过构造含sleep函数的恶意orderby参数，利用响应时间差执行时间盲注，窃取数据库敏感信息。
WordPress Events Manager /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2025-6970）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-6970
https://www.wordfence.com/threat-intel/vulnerabilities/id/7320c06e-a7a7-4ed0-93cd-e85d74bae73f?source=cve
https://wpscan.com/vulnerability/a0124b2a-0e64-443a-aa7d-d51d25c87a84/
https://cve.imfht.com/poc_detail/179ca608541b8a560e22da9a2fba6942ad253cb5?lang=en
https://www.sentinelone.com/vulnerability-database/cve-2025-6970/
https://access.redhat.com/security/cve/cve-2025-6970
https://www.ionix.io/threat-center/cve-2025-6970/
https://github.com/advisories/GHSA-h9rg-w6pv-pfwm
https://s4e.io/tools/wordpress-events-manager-sql-injection-cve-2025-6970