The Events Manager plugin for WordPress is vulnerable to a time‑based SQL Injection through the orderby parameter in all releases up to and including 7.0.3; the value supplied by the user is concatenated into an existing query without proper escaping or preparation. An attacker can append additional SQL commands to the query, enabling the extraction of sensitive database contents without any authentication. This flaw directly compromises data confidentiality and could also allow attackers to influence query execution flow.

WordPress sites that use the Events Manager – Calendar, Bookings, Tickets, and more! plugin from netweblogic in version 7.0.3 or earlier. Any installation hosting this plugin and not yet patched is susceptible.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of 42% reflects a relatively high likelihood of exploitation within the next 30 days. The vulnerability is not listed in the CISA KEV catalog, but its unauthenticated nature means that any visitor can craft a URL with a malicious orderby value to trigger the injection and gain unrestricted database access, potentially leading to data exfiltration.