CVE-2026-87774: Tz Weekly Radio Schedule WordPress SQLI

CVE-2026-87774 Overview

CVE-2026-87774 is an unauthenticated SQL injection vulnerability in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1. The plugin exposes an AJAX action to unauthenticated users and fails to sanitize or escape a parameter before incorporating it into a SQL query. Attackers can inject arbitrary SQL statements over the network and extract sensitive data from the WordPress database. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, exposing credentials, session data, and other stored information.

Affected Products

Tz Weekly Radio Schedule WordPress plugin versions up to and including 1.8.1
WordPress sites with the plugin installed and activated
Any hosting environment exposing the vulnerable AJAX endpoint to unauthenticated visitors

Discovery Timeline

2026-09-18 - CVE-2026-87774 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-87774

Vulnerability Analysis

The Tz Weekly Radio Schedule plugin registers an AJAX action that is reachable through the standard WordPress admin-ajax.php endpoint without requiring authentication. The handler reads a request parameter and concatenates its value directly into a SQL query executed against the WordPress database. Because the plugin does not apply esc_sql(), $wpdb->prepare(), or an equivalent parameterization primitive, the query is fully controllable by the caller.

An attacker can supply crafted SQL fragments in the vulnerable parameter to alter query logic, append UNION SELECT clauses, or trigger time-based inference. Successful exploitation allows extraction of arbitrary data from tables such as wp_users, including password hashes and session tokens. The vulnerability carries CWE-89 classification and reflects a scope-changed impact because compromise of the database exposes data beyond the plugin itself.

Root Cause

The root cause is missing input sanitization and lack of prepared statements in the AJAX handler. The plugin trusts caller-supplied input and passes it verbatim into a query string. Registering the AJAX callback under both wp_ajax_ and wp_ajax_nopriv_ prefixes exposes the sink to unauthenticated requests, removing any barrier to exploitation.

Attack Vector

Exploitation requires only network access to a WordPress site running the vulnerable plugin. An attacker sends an HTTP POST or GET request to admin-ajax.php specifying the vulnerable action and injecting SQL syntax into the affected parameter. No user interaction and no credentials are required. Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-87774

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing SQL keywords such as UNION, SELECT, SLEEP(, or information_schema in parameter values
Web server logs showing repeated requests to the plugin's AJAX action from a single source with varying payload lengths
Database error entries in debug.log referencing SQL syntax errors originating from the plugin's query

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL metacharacters and boolean or time-based injection patterns in AJAX parameters
Audit installed WordPress plugins and inventory sites running Tz Weekly Radio Schedule at version 1.8.1 or earlier
Enable MySQL general query logging in staging environments to identify anomalous queries containing attacker-controlled fragments

Monitoring Recommendations

Alert on spikes in admin-ajax.php traffic volume or response size that may indicate data exfiltration through UNION-based injection
Monitor outbound traffic from web servers for unexpected database dumps or large HTTP responses to unauthenticated clients
Correlate WordPress access logs with database query logs to detect injection attempts followed by successful data retrieval

How to Mitigate CVE-2026-87774

Immediate Actions Required

Deactivate and remove the Tz Weekly Radio Schedule plugin until a patched release is verified
Rotate WordPress administrator passwords, API keys, and secrets stored in the database if exploitation is suspected
Deploy WAF signatures blocking SQL injection payloads targeting the plugin's AJAX action

Patch Information

No fixed version is listed in the advisory at the time of publication. All releases through 1.8.1 are vulnerable. Monitor the WPScan Vulnerability Report for updates on a patched release.

Workarounds

Restrict access to /wp-admin/admin-ajax.php for the vulnerable action at the reverse proxy or WAF layer
Apply virtual patching rules that reject requests containing SQL metacharacters in the plugin's AJAX parameters
Enforce least-privilege database credentials for the WordPress user to limit the scope of data readable via injection

bash

# Example nginx rule to block the vulnerable AJAX action until patched
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "tz_weekly_radio") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}