SQL Injection Vulnerability in Tz Weekly Radio Schedule Plugin by WordPress
CVE-2026-87775

Currently unrated

Key Information:

Vendor

WordPress
Status
Tz Weekly Radio Schedule
Vendor
CVE Published:
18 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-87775?

The Tz Weekly Radio Schedule plugin for WordPress, up to version 1.8.1, is susceptible to SQL injection attacks. This vulnerability arises from insufficient sanitization and escaping of parameters in AJAX actions, which are accessible to unauthenticated users. As a result, attackers can exploit this flaw to manipulate SQL queries, potentially exposing sensitive data stored in the database.

Affected Version(s)

Tz Weekly Radio Schedule 0 <= 1.8.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-87775 - Proof of Concept

References

https://wpscan.com/vulnerability/5a2ed5cd-1a05-4b54-b604-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini - Claudio Marchesini - Dottor Marc
WPScan
.