A critical SQL injection vulnerability in the Tz Weekly Radio Schedule plugin allows unauthenticated attackers to extract sensitive database information.

The plugin contains a SQL injection flaw where user supplied input is not sanitized or escaped before being utilized in database queries, specifically within an AJAX endpoint that is accessible to unauthenticated users.

This vulnerability carries a CVSS score of 8.6, representing a high risk to organizational data integrity and confidentiality. Successful exploitation allows an attacker to bypass authentication mechanisms to query the backend database directly, potentially leading to the theft of user credentials, sensitive configuration data, or private site content.

Immediate Action: As no patch is currently confirmed, administrators should immediately deactivate and remove the Tz Weekly Radio Schedule plugin from all WordPress installations.

Proactive Monitoring: Security teams should review server access logs and database query logs for anomalous activity, specifically looking for repeated SQL syntax errors or unexpected database interactions originating from unauthenticated sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting AJAX endpoints.

Public Exploit Available: Unknown.

Given the high severity and the lack of a verified patch, the risk of data compromise remains unacceptable for production environments. Organizations are strongly advised to remove the plugin entirely until the vendor releases a secure version that addresses the underlying SQL injection vulnerability.