JNews Paywall CVE-2025-67591
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CSRF requires no privileges, network attack vector, low complexity, user interaction, and limited integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: from n/a through < 12.0.1.
AnalysisAI
Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.
Technical ContextAI
The flaw is a Cross-Site Request Forgery (CWE-352) in the JNews Paywall plugin by jegtheme. CSRF vulnerabilities arise when a web application does not adequately verify that a state-changing request was intentionally sent by the authenticated user. In WordPress plugins, this typically results from missing or improperly validated nonces. The CPE identifier for the affected software is not supplied, but the Patchstack advisory indicates the vulnerable component is the 'jnews-paywall' plugin for WordPress.
Affected ProductsAI
JNews Paywall plugin for WordPress, all versions prior to 12.0.1. The exact lower version bound is not specified, but the advisory states the vulnerability affects releases from 'n/a' through less than 12.0.1. The Patchstack advisory can be referenced at: https://patchstack.com/database/Wordpress/Plugin/jnews-paywall/vulnerability/wordpress-jnews-paywall-plugin-12-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
RemediationAI
Update the JNews Paywall plugin to version 12.0.1 or later, which addresses this CSRF vulnerability according to the Patchstack advisory. If an immediate update is not feasible, consider temporarily disabling the plugin to eliminate the risk, though this will also remove the paywall functionality. Verify the update through the WordPress plugin administration panel or by downloading the latest version from the official repository. No other specific workarounds are documented.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today