JNews - Pay Writer WordPress plugin: Blind SQL injection

Summary

The WordPress plugin JNews - Pay Writer (slug jnews-pay-writer) up to and including version 12.0.1 contains a blind SQL injection flaw. An unauthenticated remote attacker can send crafted requests to the website to read, modify or delete database content, including user accounts and private data. The CVSS score is 9.3 (critical), but the impact depends on the plugin being installed and reachable on a public website.

Affected

• JNews - Pay Writer WordPress plugin, versions up to and including 12.0.1 (per CNA record: "from n/a through 12.0.1")

Fixed in

• Unknown. The CNA and Patchstack recommend updating to version 12.0.2 or later, but this fix has not been independently confirmed by the vendor.

Workaround

• No vendor-published mitigation found.
• Deactivate and remove the plugin if it is not needed.
• Check whether a Patchstack virtual patch or WAF rule is active for this CVE.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept and no known exploitation in the wild found at the time of research.
• EPSS 0.00229 (low).
• Patchstack rates it as high priority and reports the vulnerability is likely to be exploited.

Our recommendation

• Check all WordPress sites for the jnews-pay-writer plugin and its version.
• If installed, update to 12.0.2 or later once confirmed, or deactivate and remove the plugin.
• If no fix is confirmed, apply a WAF or virtual patch and monitor logs for SQL errors or unusual query patterns.
• Re-check NVD and CISA KEV, as the NVD analysis was still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• CVE record (CVEProject cvelistV5) raw.githubusercontent.com
• Strix CVE entry www.strix.ai
• Vulners (Rapid7) entry vulners.com
• Threat Intel CVE entry cve.threatint.com
• Liquid Web vulnerability report, January 2026 www.liquidweb.com
• JNews v10 product information jnews.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:47.