Vulnerability record · CVE-2025-6970 · published 9 July 2025
CVE-2025-6970: Events Manager WordPress plugin unauthenticated SQL injection via orderby
PPixelite · Events Manager
The Events Manager plugin for WordPress fails to escape the user-supplied 'orderby' parameter and does not sufficiently prepare the underlying SQL query, allowing time-based SQL injection in all versions up to and including 7.0.3. Because the flaw is reachable without authentication, any remote visitor can inject SQL into existing queries. This matters for any site running the affected plugin, as database contents can be extracted.
Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote SQL injection with high confidentiality impact and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is documented.
What it is
The Events Manager plugin for WordPress fails to escape the user-supplied 'orderby' parameter and does not sufficiently prepare the underlying SQL query, allowing time-based SQL injection in all versions up to and including 7.0.3. Because the flaw is reachable without authentication, any remote visitor can inject SQL into existing queries. This matters for any site running the affected plugin, as database contents can be extracted.
Impact
An unauthenticated attacker can append arbitrary SQL to existing queries and extract sensitive information from the WordPress database, such as user credentials and other stored data. The CVSS vector indicates high confidentiality impact with no integrity or availability impact.
Attack surface
Reachable over the network through the plugin's 'orderby' parameter, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any exposed WordPress installation running the affected plugin version is a candidate target.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.65 probability (99th percentile), indicating elevated likelihood of exploitation. A patch reference is available, confirming the issue was fixed.
What to do
- Update the Events Manager plugin to a version newer than 7.0.3, which contains the fix referenced in the changeset.
- If immediate patching is not possible, disable or remove the plugin until it can be updated.
- Deploy a web application firewall rule to block SQL injection patterns targeting the 'orderby' parameter.
- Review database and web logs for suspicious 'orderby' values and unexpected SQL errors.
- Restrict database account privileges used by WordPress to the minimum required.
Detection
- Search web server logs for requests containing SQL keywords or time-delay functions in the 'orderby' parameter.
- Monitor for abnormal response delays consistent with time-based SQL injection attempts.
- Alert on SQL syntax errors or unexpected query failures in WordPress or database logs.
- Audit database queries for injected UNION or subquery patterns originating from plugin parameters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2025-6970 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-6970), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
