CVE-2025-6970

The Events Manager plugin for WordPress (all versions up to and including 7.0.3) contains a time-based SQL injection (CWE-89) in the 'orderby' parameter, caused by insufficient escaping of user-supplied input and inadequate preparation of the existing SQL query. An unauthenticated attacker can submit a crafted 'orderby' value to append additional SQL queries into existing ones and use time-based techniques (delays in responses) to infer results. Successful exploitation allows extraction of sensitive information from the site's database, with no privileges or user interaction required (CVSS 7.5 High, high confidentiality impact). Any WordPress site running Events Manager 7.0.3 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the high EPSS score of 65.6% (99th percentile) indicates a substantial likelihood of exploitation within the next 30 days.

What to do: Update Events Manager to the latest patched release (anything newer than 7.0.3) as soon as possible, prioritizing internet-facing sites. Until patched, apply a WAF rule or virtual patch that restricts or sanitizes the 'orderby' parameter on Events Manager endpoints, and review web logs and database activity for signs of time-based injection attempts or data extraction.