Critical SQL Injection Flaw Found in JNews Pay Writer Plugin

A critical security vulnerability has been identified in the JNews Pay Writer WordPress plugin, exposing websites to blind SQL injection attacks. The flaw, tracked as CVE-2026-96328, affects all versions of the software up to and including 12.0.1.

The National Vulnerability Database (NVD) has assigned the issue a CVSS score of 9.3, classifying it as Critical severity. The vulnerability stems from improper neutralization of special elements used in SQL commands. Specifically, the defect allows attackers to execute blind SQL injection, a technique where the attacker sends a database query and learns information based on the application’s response, rather than seeing the direct results of the query. This type of attack can lead to unauthorized access to sensitive data, including user credentials, personal information, and other database contents.

Context and Background

SQL injection remains one of the most prevalent and dangerous web application vulnerabilities. According to the Common Weakness Enumeration (CWE), this specific issue falls under CWE-89, which describes improper neutralization of special elements in SQL commands. When an application fails to properly sanitize user input before incorporating it into a SQL statement, attackers can manipulate the query structure.

In the case of CVE-2026-96328, the vulnerability is located within the jegtheme JNews - Pay Writer plugin. This plugin is designed to allow users to submit paid content to WordPress sites. Because the plugin processes user inputs for payment and content submission, it handles data that, if not properly validated, can be exploited to bypass security controls. The NVD record explicitly states that the vulnerability allows for blind SQL injection, indicating that while the attacker may not see the direct output of the injected query, they can still extract data or manipulate the database through indirect feedback mechanisms.

Who Is Affected

The vulnerability impacts any WordPress installation using the JNews Pay Writer plugin. The NVD record specifies that the issue affects versions from the initial release (noted as n/a) through version 12.0.1. This means that any site running version 12.0.1 or any earlier version is potentially vulnerable. Website administrators and security professionals managing WordPress environments should verify the version of the JNews Pay Writer plugin currently installed on their systems. If the installed version is 12.0.1 or lower, the site is considered at risk until a patched version is confirmed and deployed.

No fix has been confirmed yet in the available source material. Users should monitor official channels from the vendor, jegtheme, for updates regarding a security patch.

What should you do?

Security professionals should immediately audit their WordPress installations for the presence of the JNews Pay Writer plugin. If the plugin is installed, check the version number against the affected range. While waiting for a vendor patch, consider restricting access to the plugin’s functionality if possible, or taking the site offline if it is actively processing sensitive user data and cannot be secured otherwise. Monitor server logs for unusual SQL query patterns or unexpected application responses that may indicate exploitation attempts.