CVE-2026-87775: Tz Weekly Radio Schedule WordPress SQLi

CVE-2026-87775 Overview

The Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 contains an unauthenticated SQL injection vulnerability [CWE-89]. The plugin fails to sanitize and escape a parameter before using it in a SQL query within an AJAX action exposed to unauthenticated users. Attackers can inject arbitrary SQL statements to extract sensitive data from the WordPress database. The flaw requires no authentication, no user interaction, and can be triggered remotely over the network.

Critical Impact
Unauthenticated remote attackers can exfiltrate database contents, including user credentials, session tokens, and configuration secrets stored in the WordPress database.

Affected Products

Tz Weekly Radio Schedule WordPress plugin versions up to and including 1.8.1
WordPress installations with the vulnerable plugin activated
Any site exposing the plugin's unauthenticated AJAX endpoint

Discovery Timeline

2026-09-18 - CVE-2026-87775 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-87775

Vulnerability Analysis

The vulnerability resides in an AJAX action handler registered by the Tz Weekly Radio Schedule plugin. WordPress plugins register AJAX endpoints via the wp_ajax_nopriv_{action} hook to serve unauthenticated requests. This plugin concatenates a user-controlled parameter directly into a SQL query without applying $wpdb->prepare() or the escape helpers such as esc_sql().

Because the endpoint is reachable via wp-admin/admin-ajax.php without authentication, any remote attacker with network access to the WordPress site can invoke it. Successful exploitation lets attackers read arbitrary tables in the WordPress database, including wp_users password hashes and wp_options values that store API keys and secrets.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The plugin builds SQL strings through concatenation of HTTP request parameters rather than using parameterized queries. WordPress provides $wpdb->prepare() specifically to prevent this class of flaw, but the vulnerable code path bypasses it.

Attack Vector

Attack traffic originates over the network and targets the plugin's unauthenticated AJAX action at /wp-admin/admin-ajax.php. The attacker submits a crafted POST or GET request containing the vulnerable parameter with SQL syntax payloads such as UNION SELECT clauses. The database returns injected query results through the AJAX response, enabling data extraction through classic in-band SQL injection or time-based blind techniques. See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-87775

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing the Tz Weekly Radio Schedule plugin's AJAX action
Request parameters containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA
Anomalous outbound response sizes from admin-ajax.php indicating large data returns
Repeated requests from a single IP with incrementing payload variations characteristic of automated SQLi tools

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect admin-ajax.php parameters for SQL metacharacters
Enable WordPress database query logging and alert on queries containing untrusted string concatenation patterns
Correlate access logs against known WPScan vulnerability signatures for the plugin identifier

Monitoring Recommendations

Monitor authentication log tables for unexpected reads of wp_users outside normal administrative sessions
Track spikes in AJAX request volume against endpoints associated with third-party plugins
Alert on HTTP 500 responses from admin-ajax.php that may indicate malformed injection attempts

How to Mitigate CVE-2026-87775

Immediate Actions Required

Deactivate and remove the Tz Weekly Radio Schedule plugin until a patched release is available
Rotate all WordPress administrator passwords and any secrets stored in wp_options
Review database audit logs for evidence of unauthorized SELECT activity against sensitive tables
Restrict access to /wp-admin/admin-ajax.php at the network edge where feasible

Patch Information

No vendor-supplied patch is referenced in the available advisory data. Versions through 1.8.1 remain vulnerable. Consult the WPScan Vulnerability Advisory for the latest fix status and upgrade guidance.

Workarounds

Block requests to the plugin's AJAX action at the WAF layer until a fixed version is deployed
Apply virtual patching rules that reject admin-ajax.php parameters containing SQL syntax
Enforce least-privilege on the WordPress database user to limit the scope of accessible tables
Uninstall the plugin entirely if radio scheduling functionality is not business-critical

bash

# Example WAF rule to block SQLi patterns against admin-ajax.php
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1008775,msg:'Block SQLi on Tz Weekly Radio Schedule AJAX'"
  SecRule ARGS "@rx (?i)(union\s+select|information_schema|sleep\s*\(|benchmark\s*\()" \
    "t:none,t:urlDecodeUni"