JNews Pay Writer CVE-2026-96328

The affected component is the jegtheme JNews - Pay Writer WordPress plugin, versions from n/a through 12.0.1, so exploitation requires that this specific companion plugin be installed and active on a WordPress site (the base JNews theme alone is insufficient). The flaw is a blind SQL injection, meaning no output is returned directly and the attacker must infer data via boolean/time-based inference, which slows but does not prevent exploitation. The description specifies no feature toggle, configuration mode, or user interaction, and the CVSS vector asserts PR:N/UI:N; the principal limiting factors are therefore the plugin's bounded deployment footprint and the unverified assumption that no authentication is needed - if the vulnerable endpoint in fact requires a logged-in role, that authentication requirement would be the real gating condition.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3 Critical, assigned by Patchstack) describes a network-reachable, low-complexity, unauthenticated blind SQL injection with scope change and high confidentiality impact - a profile that normally warrants priority attention. However, the real-world risk signals are thin: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced (the sole reference is the Patchstack advisory). There is therefore no public exploit identified at time of analysis, and no evidence of active exploitation - the high score is driven entirely by the theoretical CVSS metrics, not by observed activity. One point warrants verification: Patchstack-reported WordPress plugin SQLi flaws frequently require at least low-privilege authentication (e.g., subscriber/contributor) in practice, yet the vector claims PR:N; the description does not specify any privilege or configuration prerequisite, so the unauthenticated claim should be confirmed against the vendor advisory before treating this as fully pre-auth. Net: a genuinely serious bug class (blind SQLi) in a bounded-footprint plugin, but currently a 'high CVSS, unproven real-world exploitation' issue - patch promptly where the plugin is deployed, but no KEV/EPSS pressure indicates mass exploitation today.

A remote attacker sends crafted input to a vulnerable parameter of the JNews - Pay Writer plugin (<=12.0.1) that is concatenated into a SQL query, and uses boolean- or time-based blind injection to infer database contents such as user records and credential hashes. Given AV:N/AC:L/UI:N, exploitation is remote and automatable with standard tools like sqlmap. No public exploit is identified at time of analysis, so an attacker would need to rediscover the injectable endpoint.