Jnews Pay Writer
Monthly
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.