An unauthenticated SQL injection vulnerability in the Tz Weekly Radio Schedule WordPress plugin allows remote attackers to extract sensitive database content.

The plugin fails to sanitize and escape parameters used in SQL queries within an AJAX action. This allows an unauthenticated attacker to inject malicious SQL commands and access unauthorized data.

The vulnerability carries a CVSS score of 8.6, reflecting the high risk posed by unauthenticated access to the backend database. Successful exploitation could lead to the exposure of sensitive user data, configuration details, or administrative credentials, resulting in significant privacy breaches and potential regulatory non-compliance.

Immediate Action: Remove the Tz Weekly Radio Schedule plugin from your WordPress installation immediately, as no official patch is currently available.

Proactive Monitoring: Review database access logs for unusual queries or unauthorized patterns originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common SQL injection patterns to add a layer of protection if the plugin cannot be immediately removed.

Public Exploit Available: No

Given the high severity of this SQL injection vulnerability and the lack of a vendor-provided patch, the only effective mitigation is the immediate removal of the affected plugin. Administrators should conduct a thorough audit of their WordPress environment to ensure no other vulnerable components are present and prioritize the removal of unused or unsupported plugins to reduce the attack surface.