Executive brief
The Tz Weekly Radio Schedule WordPress plugin contains an SQL injection vulnerability in an AJAX handler that is accessible to unauthenticated users. An attacker can exploit this flaw to extract sensitive data directly from the website's database, including user information, configuration details, and other stored content without needing a valid account or login credentials.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the plugin's AJAX action handler. The vulnerable parameter (the "week" parameter based on the WPScan title) is passed directly into a SQL query without proper sanitization or escaping. Since the AJAX endpoint is available to unauthenticated users, an attacker can craft a malicious query string to inject arbitrary SQL commands. This allows database enumeration, data extraction, and potentially further compromise depending on database permissions. No official patch has been released as of the advisory date.
Affected products
- Tz Weekly Radio Schedule through 1.8.1
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory