CVE-2026-96328 in JNews Pay Writer Plugin
Summary
by MITRE • 10/09/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL injection. This specific flaw resides within the jnews-pay-writer component of the JNews theme ecosystem for WordPress. The nature of this vulnerability is classified as Blind SQL Injection, which distinguishes it from error-based or union-based variants by its reliance on indirect data extraction rather than direct output display. In a blind scenario, the application does not return database query results directly to the user interface. Instead, an attacker must infer information based on the application's response behavior, such as differences in page load times, HTTP status codes, or boolean conditions returned during normal operation. This makes detection and exploitation more challenging for automated scanners but equally dangerous because it allows for precise data exfiltration over time without triggering obvious error messages that might alert administrators to the breach.
The technical root cause lies in the failure of the jnews-pay-writer plugin to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries executed against the backend database. When a request is processed, particularly those related to payment processing, writer profiles, or subscription management features inherent to this premium add-on, specific parameters are passed directly into dynamic SQL statements without adequate validation. An attacker can craft malicious payloads containing SQL syntax that alters the logic of these queries. By manipulating boolean conditions within the injected code, such as appending AND 1=1 OR 1=2 sequences, an observer can determine if a condition is true or false based on whether the page loads successfully or fails silently. This technique enables the extraction of sensitive database contents, including user credentials, payment tokens, personal identifiable information, and administrative session data, one bit at a time through careful observation of application responses.
The operational impact of this vulnerability extends beyond simple data theft to include potential full system compromise depending on the privileges granted to the database account running under WordPress. If the database user has elevated permissions, an attacker could potentially write files to the server's file system using SQL commands like INTO OUTFILE or LOAD_FILE, thereby achieving remote code execution. Even without such high-level access, the ability to read arbitrary data from the database poses a severe risk to privacy and financial security. Since JNews is often used by media outlets and publishers handling subscriber payments, the exposure of credit card information or user login credentials can lead to significant reputational damage, regulatory fines under standards like GDPR or PCI-DSS, and loss of customer trust. The vulnerability affects versions from n/a through 12.0.1, indicating a long-standing issue that may have persisted across multiple releases if not promptly addressed by the developers.
From a classification perspective, this flaw aligns with CWE-89: Improper Neutralization of Special Elements used in an SQL Command and maps to MITRE ATT&CK technique T1059.004: SQL Commands, specifically within the context of Application Layer Attacks. The blind nature of the injection also relates to data exfiltration techniques where attackers use side-channel information rather than direct output. Mitigation strategies must focus on both immediate remediation and long-term secure coding practices. Administrators should immediately update the JNews - Pay Writer plugin to a version later than 12.0.1, assuming the vendor has released a patch that addresses this specific input validation failure. If an updated version is not yet available, temporary mitigations include implementing Web Application Firewall rules that detect and block common SQL injection patterns in POST or GET parameters associated with payment endpoints. Additionally, enforcing strict parameterized queries or prepared statements within the plugin's codebase during future development cycles will ensure that user inputs are treated strictly as data rather than executable code, effectively neutralizing this class of vulnerability at its source.