Is Your JNews Pay Writer Site Vulnerable To CVE-2026-96328 Blind SQL Injection Risk?

The short version

• A critical SQL injection vulnerability exists in the JNews Pay Writer plugin
• The flaw is classified as CWE-89 improper neutralization of special elements
• Versions from n/a through 12.0.1 are vulnerable according to the NVD record

The details

The National Vulnerability Database recorded CVE-2026-96328 as a critical severity issue on the CVSS scale, assigning it a score of 9.3. This high rating reflects the potential for significant data compromise through the exploitation of the flaw. The vulnerability stems from improper neutralization of special elements used in SQL commands, specifically enabling blind SQL injection attacks.

The affected component is the JNews - Pay Writer plugin developed by jegtheme. The NVD record states that the issue affects versions from n/a through 12.0.1. This means any installation running version 12.0.1 or earlier is potentially exposed to exploitation. The weakness allows attackers to inject malicious SQL code into queries, potentially extracting sensitive data or manipulating the database without direct feedback in the application response.

The context

SQL injection remains one of the most prevalent and dangerous web application vulnerabilities. The CWE-89 classification highlights the failure to properly sanitize user input before incorporating it into database queries. Blind SQL injection is particularly insidious because it does not return error messages or data directly to the attacker. Instead, attackers infer data by observing changes in application behaviour or response times, making detection more difficult for standard monitoring tools.

Next steps

Security teams should immediately audit their WordPress installations for the presence of the JNews Pay Writer plugin. Administrators must verify the current version number against the affected range. If the plugin is active and running version 12.0.1 or lower, it requires urgent attention. There is no confirmed patch mentioned in the source material, so disabling the plugin may be necessary until a secure update is available from the vendor.

What to do and how to stay safe: CVE-2026-96328

• Inventory all WordPress plugins and identify any installations of JNews Pay Writer
• Check the version number of the plugin against the affected range up to 12.0.1
• Monitor server logs for unusual database query patterns or delayed responses
• Disable the plugin if a secure update is not yet available from the vendor

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96328?

The CVSS score is 9.3, which is classified as critical severity.

Which versions of JNews Pay Writer are affected?

Versions from n/a through 12.0.1 are affected by this vulnerability.

What type of vulnerability is this?

It is a blind SQL injection vulnerability classified as CWE-89.