CVE-2026-87775: Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Tz Weekly Radio Schedule WordPress pluginto a version that resolves this vulnerability.Fixed in 1.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit the affected AJAX action; no WordPress account is required.
What access or configuration is required for exploitation?
The vulnerable tzwrs_update_cell AJAX action must be reachable in an installation running the affected plugin. The available data does not identify any additional configuration prerequisite.
What is the potential impact of successful exploitation?
An attacker may perform SQL injection and extract sensitive information from the WordPress database.
How can I determine whether an installation is affected?
Check whether Tz Weekly Radio Schedule is installed and whether its version is 1.8.1 or earlier. Those versions are identified as affected.