Read the docs
TI-2026-69944 Aliases CVE-2026-96328GHSA-qhfm-h7x3-vwc8

Blind SQL injection in JNews - Pay Writer WordPress plugin

Priority MEDIUM 45CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The JNews - Pay Writer plugin for WordPress by jegtheme is affected in all versions up to and including 12.0.1. Improper neutralization of special elements in an SQL command (CWE-89) allows blind SQL injection. An unauthenticated remote attacker can exploit it over the network without user interaction, with high impact to confidentiality and low impact to availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jegthemeJNews - Pay Writerup to 12.0.1—No fix listedCNA
  • JNews - Pay Writer Vendorjegtheme Affected up to 12.0.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for JNews - Pay Writer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-96328
  2. 2026-10-09 Alias added: GHSA-qhfm-h7x3-vwc8
  3. 2026-10-10 CISA SSVC decision points changed

References

Other 1

  • TI-2022-03477 Jeg Elementor Kit <= 2.5.6 - Authorization Bypass CVSS 3.1MEDIUM 5.4
  • TI-2022-03486 Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass CVSS 3.1HIGH 8.6
  • TI-2025-42363 WordPress JNews - Pay Writer plugin <= 11.0.0 - Local File Inclusion vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-46719 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
  • TI-2026-15125 Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVSS 3.1HIGH 7.2
  • TI-2025-42364 WordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences