CVE-2026-87774 in Tz Weekly Radio Schedule Plugin
Summary
by MITRE • 09/18/2026
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Tz Weekly Radio Schedule WordPress plugin versions through 1.8.1 represents a critical security flaw rooted in insufficient input validation and output encoding mechanisms. Specifically, the application fails to properly sanitize or escape user-supplied parameters prior to their incorporation into SQL query structures. This deficiency occurs within an AJAX endpoint that is accessible without requiring any form of authentication, thereby exposing the underlying database infrastructure to direct exploitation by external actors who do not possess valid credentials for the WordPress administration panel.
From a technical perspective, this flaw constitutes a classic instance of blind or error-based SQL injection depending on the server configuration and error reporting settings. When an unauthenticated user submits maliciously crafted input via the AJAX action parameter, the application constructs a database query using raw string concatenation rather than prepared statements with parameterized queries. This allows attackers to inject arbitrary SQL commands that are executed by the backend database management system. The lack of escaping means special characters such as single quotes and semicolons are interpreted as structural elements of the SQL syntax rather than literal data, enabling the manipulation of query logic.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers can exploit this weakness to extract sensitive information stored in the WordPress database, including user credentials, session tokens, configuration details, and potentially other site-specific data depending on the schema structure. This compromise undermines the confidentiality and integrity of the entire web application ecosystem hosted on the same server or sharing the same database instance. Furthermore, successful exploitation could serve as a foothold for further attacks, such as privilege escalation to administrative accounts if password hashes are retrieved and cracked, leading to complete site takeover.
In terms of industry standard classifications, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command within the Common Weakness Enumeration framework. It also maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter subcategory for database commands or more specifically T1190 Exploit Public-Facing Application, as it leverages a publicly accessible interface to execute malicious code against the backend data store. The absence of authentication requirements places this in the initial access phase of an attack lifecycle where low-skilled adversaries can achieve significant impact with minimal effort.
Mitigation strategies must prioritize immediate remediation through software updates or manual patching if an update is not yet available from the vendor. Administrators should upgrade to a version of Tz Weekly Radio Schedule that addresses this sanitization issue, ensuring all user inputs are validated against expected formats and escaped using database-specific functions before query execution. In environments where updating is delayed, implementing Web Application Firewall rules can help detect and block SQL injection patterns targeting the specific AJAX endpoint. Additionally, restricting access to administrative-ajax.php or custom AJAX endpoints via IP whitelisting for internal networks only provides a temporary layer of defense against unauthenticated exploitation attempts while permanent fixes are deployed.