CVE-2025-6970

What it actually does

The WordPress Events Manager plugin fails to properly escape and parameterize user-controlled input supplied through the `orderby` parameter. An unauthenticated attacker can inject SQL syntax into an existing database query and use time-based blind SQL injection techniques, such as conditional delays, to infer database contents without needing valid WordPress credentials. The most likely technical outcome is unauthorized extraction of sensitive data from the WordPress database, including user records, password hashes, emails, plugin data, booking information, and other site content accessible to the database user.

Why it matters to the business

A public WordPress site running a vulnerable version of the Events Manager plugin may expose sensitive website and user data to remote attackers without authentication. Because exploitation is weaponized and the EPSS likelihood is high, vulnerable internet-facing sites should be treated as likely targets. Successful exploitation can lead to data breach obligations, account compromise through stolen password hashes, reputational damage, fraud against event or booking workflows, and follow-on attacks against administrators or customers.

How an attack unfolds

An attacker identifies a WordPress site using the Events Manager plugin at version 7.0.3 or earlier. They send crafted HTTP requests to plugin functionality that accepts an `orderby` value. Instead of supplying a normal sort field, the attacker injects SQL expressions that alter the backend query. Because the flaw is time-based, the attacker observes response delays caused by injected database functions to determine whether specific conditions are true or false. By repeating these requests, they can enumerate database metadata and gradually extract sensitive values such as usernames, email addresses, password hashes, booking data, or other stored content. The attack does not require login access and can be automated at scale against exposed WordPress sites.

How to fix it

Upgrade the Events Manager plugin to a vendor-fixed release newer than 7.0.3 as soon as possible. If a fixed package is not immediately available in the deployment channel, disable or remove the plugin until it can be safely updated. Restrict exposure of affected event, booking, and calendar endpoints where feasible, and deploy a web application firewall rule that blocks SQL injection payloads in the `orderby` parameter. Review database permissions for the WordPress application user and ensure it has only the minimum privileges required. Rotate WordPress administrator passwords and invalidate sessions if exploitation is suspected, especially if database contents may have been exposed.

How to confirm the fix worked

Confirm that no WordPress installation is running Events Manager version 7.0.3 or earlier. Validate through the WordPress admin plugin page, filesystem plugin metadata, software inventory, or vulnerability scanner results. After upgrading, send benign requests using expected `orderby` values and confirm normal application behavior. Security teams can also test with a safe non-destructive time-delay payload in a controlled manner and verify that the request is blocked or does not produce database-induced response delays. Confirm that WAF or reverse proxy controls log and block suspicious `orderby` payloads containing SQL functions, comments, boolean expressions, or time-delay keywords.

Typical attack path

1. Scan the internet for WordPress sites running the Events Manager plugin.
2. Confirm that the installed plugin version is 7.0.3 or earlier, or attempt exploitation opportunistically.
3. Send unauthenticated HTTP requests containing a malicious `orderby` parameter.
4. Inject time-delay SQL payloads to confirm vulnerability through abnormal response latency.
5. Use blind SQL inference to enumerate database tables, columns, and values.
6. Extract sensitive records such as WordPress users, email addresses, password hashes, booking records, or event-related data.
7. Use recovered data for credential cracking, phishing, privilege escalation, or resale.

How to detect it

Review HTTP access logs from web servers, CDNs, reverse proxies, WAFs, and WordPress security plugins for requests containing an `orderby` parameter with SQL syntax or time-delay functions. Focus on unauthenticated requests to event, calendar, booking, AJAX, or WordPress frontend routes that include payloads such as `SLEEP`, `BENCHMARK`, `IF`, `CASE WHEN`, `SELECT`, `UNION`, SQL comments, or encoded equivalents. Time-based SQL injection often appears as repeated similar requests with different conditions and unusually long response times. Correlate suspicious requests with 5xx errors, slow PHP-FPM or web server request logs, database slow query logs, and spikes in database CPU or query duration. If exploitation is suspected, examine WordPress users for unexpected administrator accounts, password or email changes, and anomalous logins after the suspected extraction window. Because the issue can be used only to infer data through timing, absence of obvious error messages does not rule out exploitation.

• orderby=
• orderby=%28
• orderby=(
• orderby=%27
• orderby='
• orderby=%22
• orderby="
• SLEEP(
• sleep(
• SLEEP%28
• sleep%28
• BENCHMARK(
• benchmark(
• BENCHMARK%28
• benchmark%28
• IF(
• IF%28
• CASE WHEN
• CASE%20WHEN
• SELECT
• SELECT%20
• UNION SELECT
• UNION%20SELECT
• INFORMATION_SCHEMA
• information_schema
• --
• %2D%2D
• #
• %23
• /*
• %2F%2A
• */
• %2A%2F
• wp-content/plugins/events-manager/
• admin-ajax.php

What your security team should do

• Prioritize remediation for internet-facing WordPress sites because exploitation is weaponized and the EPSS score indicates elevated likelihood of exploitation.
• Upgrade the Events Manager plugin to a fixed version newer than 7.0.3, or disable the plugin until an update is applied.
• Search web server, CDN, WAF, and WordPress access logs for suspicious `orderby` requests, especially those containing SQL time-delay functions.
• If suspicious activity is found, preserve logs and perform incident response focused on possible database disclosure.
• Rotate administrator credentials and invalidate active sessions where exploitation is suspected.
• Review WordPress user accounts for newly created administrators, unexpected email changes, or signs of credential misuse.
• Apply least-privilege database permissions for WordPress and remove unnecessary database grants.
• Add WAF detections for SQL injection patterns in `orderby` parameters and monitor for repeated delayed requests from the same source.