CVE Intelligence
Analysis AI-assisted

CVE-2026-96328: JNews - Pay Writer WordPress plugin: Blind SQL Injection

CVE-2026-96328 is an SQL Injection weakness (CWE-89) in the JNews - Pay Writer WordPress plugin from jegtheme, described as allowing Blind SQL Injection. The affected range runs up to and including 12.0.1, and Patchstack reports a CVSS score of 9.3 with critical severity. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL Injection weakness (CWE-89) in JNews - Pay Writer, a WordPress plugin from jegtheme. According to the description, the issue allows Blind SQL Injection, meaning attacker-controlled input can influence database queries without the results being returned directly in the page.

Impact

  • Patchstack's scoring indicates high confidentiality impact, low availability impact and no integrity impact, with a changed scope.
  • The scoring also indicates that no privileges and no user interaction are required, which is why the severity is rated critical.
  • The practical consequences for a given site depend on the database permissions and the data stored there, which the record does not describe.

Affected products and versions

The record lists JNews - Pay Writer from jegtheme as affected up to and including 12.0.1. The description says the issue applies from n/a through 12.0.1, so the lower bound is not specified. The record contains no fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The EPSS probability is 0.00229 with a percentile of 0.13009 as of 2026-10-23, and the SSVC exploitation field is none. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every site running JNews - Pay Writer and confirm the installed version against the affected range.
  • Check the vendor and the Patchstack entry for an updated release, since the record does not name a fixed version.
  • If no update is available, consider deactivating the plugin until the risk is assessed.
  • Apply the principle of least privilege to the database account used by WordPress and keep backups current.

Detection guidance

  • Review web server and application logs for unusual request parameters or repeated requests against plugin endpoints.
  • Monitor the database for query errors or timing patterns that do not match normal site activity.

Limitations of the available information

The record does not identify the vulnerable parameter, the fixed version, or the exact conditions under which the flaw is reachable. The lower bound of the affected range is stated as n/a, and the publication status is listed as Deferred. Vendor confirmation was not found in the sources consulted.

Frequently asked questions

What is CVE-2026-96328?

It is an SQL Injection weakness (CWE-89) in the JNews - Pay Writer WordPress plugin from jegtheme, described as allowing Blind SQL Injection.

Which versions are affected?

The record lists the plugin as affected up to and including 12.0.1. The lower bound is given as n/a, so it is not specified.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.