CVE-2025-6970 is a SQL Injection vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The issue arises from improper neutralization of special elements in the 'orderby' parameter, allowing unauthenticated attackers to append malicious SQL queries. This vulnerability affects all versions up to and including 7.0.3. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability. No patch or official fix has been referenced in the available data.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database without requiring authentication. The vulnerability does not affect data integrity or availability according to the CVSS vector. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or applying custom input validation and sanitization on the 'orderby' parameter to mitigate risk. Monitor vendor channels for updates and patches.