CVE-2025-6970

Deeper analysis

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is affected by a time-based SQL injection vulnerability in all versions through 7.0.3. The flaw exists in the orderby parameter because user input is not properly escaped and the existing SQL query lacks sufficient parameterization, allowing an attacker to alter query logic.

Unauthenticated remote attackers can supply a crafted orderby value to append additional SQL statements to existing queries. Successful exploitation enables extraction of sensitive information from the database without requiring authentication or user interaction, corresponding to the CVSS 7.5 rating that reflects high confidentiality impact over the network.

Public references include the Wordfence threat intelligence entry and WordPress plugin repository changesets that document the corrective update released after version 7.0.3. The EPSS score has reached a peak of 0.4243 with a current value of 0.4049, indicating moderate and relatively stable exploitation interest following disclosure.