EUVD-2026-82673
GHSA-93x5-88q4-f8c3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Tz Weekly Radio Schedule
-
DeliverySend unauthenticated request to vulnerable AJAX action
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExtract database records (hashes, PII)
-
ImpactEscalate using stolen credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated SQL injection against default configurations of the Tz Weekly Radio Schedule WordPress plugin (through version 1.8.1). The vulnerable code path is an AJAX action exposed to unauthenticated users (WordPress wp_ajax_nopriv), so no login, role, or user interaction is required; the only prerequisite is that the affected plugin is installed and active on a reachable WordPress site. The primary limiting factor is deployment footprint: this is a niche plugin, so the realistic attack surface is small despite the low technical barrier. Impact is limited to database read/extraction (confidentiality); the flaw as described does not provide write or availability impact. |
| Impact | Real, actionable priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most exploitable profile possible - remote, low-complexity, unauthenticated, no user interaction - reachable via a WordPress AJAX action registered for unauthenticated (wp_ajax_nopriv) users. Publicly available exploit code exists (WPScan), which sharply raises near-term risk versus a theoretical flaw. The vendor score of 8.6 is driven upward by S:C (scope change); this is questionable for classic in-database SQL injection where the DBMS is the same security authority as the app - a S:U reading yields ~7.5, still high. Impact is confidentiality-only (C:H/I:N/A:N): the flaw enables reading/extracting sensitive database contents (user data, password hashes, secrets), not writing or denial of service. No EPSS score and no CISA KEV entry are provided, so there is no evidence of confirmed active exploitation or a quantified probability - the elevated risk here rests on public POC availability plus trivial exploitability, not on observed in-the-wild campaigns. Net: treat as a patch-now item for any site running this plugin, tempered by the plugin's likely small install base. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's vulnerable AJAX action with a malicious value in the unsanitized parameter, injecting SQL into the backend query. Using UNION-based or blind extraction, they read arbitrary tables - for example wp_users password hashes and secret keys. Public exploit code from WPScan lowers the skill barrier, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
RemediationAI
No vendor-released patch has been identified at time of analysis: the WPScan report covers versions through 1.8.1 and the available intelligence lists no fixed version, so do not assume an upgrade path exists. The most reliable action is to deactivate and remove the Tz Weekly Radio Schedule plugin from any site that does not strictly need it - the trade-off is loss of the weekly schedule display; where the functionality is required, isolate it (for example keep it on a separate, low-privilege site or a static page) until the vendor ships a fix. As a compensating control, block requests to /wp-admin/admin-ajax.php that carry the plugin's vulnerable action parameter at the WAF or reverse-proxy layer (virtual patching), accepting that this may break the plugin's legitimate front-end behavior for unauthenticated visitors; also block broad SQL-injection metacharacter patterns on that endpoint with caution, as this can cause false positives against unrelated AJAX callers. Because exploitation requires no authentication, treat any site running the plugin as potentially compromised for database confidentiality: review web server and WAF logs for anomalous admin-ajax.php queries, check for unexpected database exports or new administrative users, and consider rotating WordPress salts, administrator passwords, and database credentials - noting that credential rotation forcibly logs out all users. Monitor the WPScan advisory URL above and the WPScan/Wordfence vulnerability feeds for a patched release, and apply it immediately when published. Since publicly available exploit code exists, prioritize remediation over monitoring alone on any internet-reachable site where the plugin is active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin. The plugin exposes an AJAX action to unauthenticated visitors, which in WordPress means the handler is registered through the wp_ajax_nopriv_* hook rather than the authenticated wp_ajax_* hook. Inside that handler an attacker-controlled parameter is used to build a SQL query without sanitization or escaping, so the input is concatenated into the statement instead of being bound through $wpdb->prepare() or a parameterized query. Because the query runs with the WordPress database user's privileges, successful injection exposes the site's tables - including user credentials, hashes, and plugin/configuration data - to enumeration and bulk extraction. The CPE string (cpe:2.3:a:unknown:tz_weekly_radio_schedule:*:*:*:*:*:*:*:*) and the EUVD entry (EUVD-2026-82673) both record all versions up to and including 1.8.1 as affected, and no fixed version is identified in the available intelligence; the disclosure was credited to WPScan. Note the assessed vector scopes the impact to the vulnerable component (S:U) with confidentiality-only impact rather than the scope-changed profile in the raw vendor score.
Know when Tz Weekly Radio Schedule gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote nopriv AJAX SQLi gives AV:N/AC:L/PR:N/UI:N and C:H data extraction; S:U since the DBMS shares the app's authority, and no write/DoS so I:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Technical POC Analysis
CWE-89 (SQL injection, OWASP A1: Injection), CVSS 8.6.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Tz Weekly Radio Schedule WordPress plugin (through version 1.8.1) exposes organizations to unauthenticated database read access, allowing remote attackers to extract arbitrary data from the underlying WordPress database without login or user interaction. Because publicly available exploit code exists and affected sites require no special access to reach the vulnerable endpoint, leadership should treat impacted WordPress estates as a confidentiality risk involving user records, credentials, and other sensitive data, though the plugin’s niche deployment footprint may limit the scope. Until a vendor patch is available, exposure must be managed through removal, isolation, or virtual patching.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Tz Weekly Radio Schedule plugin (through version 1.8.1); if it must remain, use WAF/virtual patching to block unauthenticated access to the vulnerable AJAX action, restrict the endpoint via web server rules, and monitor for data exfiltration or rotate exposed WordPress database credentials and secrets if suspicious activity is observed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB