Description
WordPress Events Manager <= 7.0.3及之前版本存在SQL注入漏洞，攻击者可利用此漏洞获取数据库中敏感信息。
WordPress Events Manager <= 7.0.3 SQL注入漏洞(CVE-2025-6970)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-6970
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/events-manager/events-manager-703-unauthenticated-sql-injection-via-orderby-parameter
https://avd.aliyun.com/detail?id=AVD-2025-6970
https://www.cnvd.org.cn/flaw/show/CNVD-2025-15642
https://vuldb.com/zh/?id.315798
https://github.com/RandomRobbieBF/CVE-2025-6970
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-object.php#L1060
https://www.nsfocus.net/vulndb/123088
https://cve.imfht.com/detail/CVE-2025-6970
https://wpscan.com/vulnerability/a0124b2a-0e64-443a-aa7d-d51d25c87a84/