Executive brief
The Tz Weekly Radio Schedule WordPress plugin contains a SQL injection vulnerability in an AJAX endpoint that does not properly sanitize user input. An unauthenticated attacker can exploit this to extract sensitive data from the WordPress database, including user credentials, personal information, and other confidential content stored in the database.
Technical details
The vulnerability is a SQL injection (CWE-89) in the tzwrs_update_cell AJAX action available to unauthenticated users. The plugin fails to sanitize and escape a parameter before incorporating it into a SQL query. An attacker can send a crafted HTTP request with malicious SQL payload to the AJAX endpoint without authentication to extract arbitrary data from the database. No known fix has been released as of the advisory publication date.
Affected products
- Tz Weekly Radio Schedule Tz Weekly Radio Schedule through 1.8.1
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory