Tz Weekly Radio Schedule
Monthly
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).