EUVD-2026-82672
GHSA-hm83-7h6c-m5rj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running plugin ≤1.8.1
-
ExploitSend crafted request to nopriv AJAX action
-
ExecutionInject SQL via unsanitized parameter
-
ImpactExfiltrate credentials and sensitive DB data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Tz Weekly Radio Schedule WordPress plugin (versions through 1.8.1). The vulnerable AJAX action is exposed to unauthenticated users (nopriv handler), so no login, role, or user interaction is required. The primary limiting factor is deployment scope: the plugin is niche and not widely installed, and impact is confidentiality-only (data extraction, no write or denial of service). Exploitation additionally requires the plugin to be installed and activated on the target site. |
| Impact | This is a genuinely high-priority issue among WordPress plugin vulnerabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, network-based exploitation with low complexity and NO authentication or user interaction - the strongest possible exposure profile - and a publicly available WPScan exploit exists, so barrier-to-entry is minimal. The one debatable signal is S:C/C:H (8.6): scope-changed is questionable for an in-database SQL injection that reads data within the same security authority, so a more defensible score is S:U/C:H = 7.5. No EPSS score and no KEV listing are provided, meaning exploitation is confirmed feasible (POC) but not yet confirmed as actively exploited in the wild - treat POC availability and active exploitation as distinct. Overall this is a real priority (unauthenticated + public exploit + data exfiltration), tempered by low real-world deployment footprint of this niche plugin and the confidentiality-only impact (I:N/A:N - no write or DoS). |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted request to the plugin's public nopriv AJAX action, injecting SQL through the unsanitized parameter to read arbitrary database contents such as user records, password hashes, and secrets. A public WPScan proof-of-concept exists, making exploitation trivial to reproduce. Because no authentication or user interaction is required (PR:N/UI:N), the attack can be fully automated and scanned at scale against exposed sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary action is to deactivate and delete the Tz Weekly Radio Schedule plugin from all WordPress installations until an official fixed release is published - this fully removes the attack surface but also removes the radio schedule functionality, so plan a replacement or a static schedule page. If the plugin must remain active, block POST and GET requests to /wp-admin/admin-ajax.php that carry the plugin's vulnerable action parameter at the WAF, reverse proxy, or web server layer; the trade-off is that legitimate front-end schedule features driven by that AJAX action will also break, so the rule must be scoped as tightly as possible and validated against normal site traffic. Because the injection is read-oriented, restricting the WordPress database user to the minimum privileges required (no FILE, no stacked-query access, no administrative schema access) reduces what an attacker can pivot to after extraction but does not prevent reading data already stored in the WordPress tables, so treat suspected compromise as a data-breach event and rotate credentials and salts stored in the database. Monitor web logs for unusually long or SQL-metacharacter-laden requests to admin-ajax.php from unauthenticated clients as a detection measure, and verify the plugin's status against the WPScan advisory at https://wpscan.com/vulnerability/802f208f-a3dd-4dc7-b1d2-ec455f0350f7/ and the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-87774 for a patched version before restoring it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-89 SQL injection in a WordPress plugin. WordPress exposes AJAX endpoints through wp-admin/admin-ajax.php, and plugins register handlers via add_action('wp_ajax_<action>', ...) for authenticated users and add_action('wp_ajax_nopriv_<action>', ...) for anonymous visitors. The Tz Weekly Radio Schedule plugin registers at least one such handler with the nopriv variant and then takes a request-supplied parameter and interpolates it directly into a SQL statement - most likely without using $wpdb->prepare() or equivalent parameter binding - before executing it against the WordPress database. Because the injection point is unauthenticated, the attacker does not need valid credentials or any WordPress role; they only need the plugin to be installed and activated. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) rates the issue as scope-changing with high confidentiality impact only; our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agrees on exploitability and impact but treats the impact as confined to the vulnerable component rather than crossing a security scope boundary. The CPE entry carries an 'unknown' vendor string (cpe:2.3:a:unknown:tz_weekly_radio_schedule:*:*:*:*:*:*:*:*), reflecting that the plugin has not been mapped to a maintained vendor record in the CPE dictionary, which also complicates automated asset matching for defenders.
Know when Tz Weekly Radio Schedule gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi with no UI justifies AV:N/AC:L/PR:N/UI:N and C:H; in-database read stays within one authority so S:U, with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Technical POC Analysis
Evidence base is a single WPScan entry (WPVDB 802f208f-a3dd-4dc7-b1d2-ec455f0350f7).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) could allow attackers to extract data from affected site databases, creating potential privacy, regulatory, and reputational exposure. Because publicly available exploit code exists and no vendor patch is currently identified, organizations with internet-facing WordPress sites running this plugin should treat it as an urgent data-protection issue until the plugin is removed or mitigated.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating and deleting the Tz Weekly Radio Schedule plugin, disabling or blocking the vulnerable AJAX action, applying WAF virtual patching for SQL injection attempts against the plugin endpoint, restricting endpoint access to trusted IP ranges where feasible, rotating database credentials, and monitoring database queries and outbound traffic for signs of data extraction. If removal is not possible, isolate the WordPress site behind stricter access controls and reduce its public exposure until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB