CVE-2026-96328: JNews Pay Writer SQL Injection Vulnerability

CVE-2026-96328 Overview

CVE-2026-96328 is a blind SQL injection vulnerability in the jegtheme JNews - Pay Writer WordPress plugin (jnews-pay-writer). The flaw affects all plugin versions up to and including 12.0.1. Attackers can inject malicious SQL statements through unsanitized input, allowing unauthorized interaction with the underlying database. The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. The issue is tracked under CWE-89 and documented in the Patchstack SQL Injection Vulnerability advisory.

Critical Impact
Unauthenticated attackers can perform blind SQL injection against WordPress sites running vulnerable versions, exposing confidential database contents and impacting site availability.

Affected Products

jegtheme JNews - Pay Writer plugin for WordPress
All versions from initial release through 12.0.1
WordPress sites with the jnews-pay-writer plugin installed and active

Discovery Timeline

2026-10-09 - CVE-2026-96328 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-96328

Vulnerability Analysis

The vulnerability is a blind SQL injection flaw in the JNews - Pay Writer plugin. The plugin fails to properly neutralize special elements used in SQL commands before incorporating user-controlled input into database queries. Because the injection is blind, attackers do not see direct query output. Instead, they infer database contents through boolean responses, time delays, or other side channels in HTTP responses.

The issue affects every release of the plugin up to version 12.0.1. Attackers can target WordPress endpoints exposed by the plugin without authentication or user interaction. Successful exploitation can lead to confidentiality loss across the WordPress database, including user credentials, session tokens, and private content stored by the plugin.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command, classified under CWE-89. The plugin concatenates untrusted input into SQL statements without prepared statements or proper escaping through WordPress functions such as $wpdb->prepare().

Attack Vector

The attack vector is remote over the network. An unauthenticated attacker sends crafted HTTP requests to a vulnerable plugin endpoint containing SQL payloads. The attacker then analyzes response differences or timing to extract data one bit at a time. Automated tooling such as sqlmap can accelerate exploitation once a vulnerable parameter is identified.

No verified exploit code is publicly available at this time. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-96328

Indicators of Compromise

HTTP requests to jnews-pay-writer plugin endpoints containing SQL metacharacters such as ', UNION, SLEEP(, BENCHMARK(, or --
Repeated requests to the same plugin endpoint with incrementally changing parameter values, indicative of blind SQLi enumeration
Unexpected database errors or elevated query execution times recorded in MySQL or MariaDB slow query logs
Outbound DNS or HTTP callbacks from the web server originating from database functions, suggesting out-of-band exfiltration

Detection Strategies

Deploy a web application firewall (WAF) with signatures tuned for WordPress plugin SQL injection patterns
Enable WordPress query logging and alert on queries with unusual string concatenation referencing plugin tables
Correlate web access logs with database query logs to identify suspicious parameter-to-query mappings
Monitor for the presence of plugin version 12.0.1 or earlier using plugin inventory scanners

Monitoring Recommendations

Alert on repeated HTTP 500 errors or anomalous response time deltas from plugin endpoints
Track authentication anomalies and new administrative user creation in WordPress following suspicious plugin traffic
Forward WordPress, web server, and database logs into a centralized analytics platform for correlation and retention

How to Mitigate CVE-2026-96328

Immediate Actions Required

Inventory all WordPress sites to identify installations of the jnews-pay-writer plugin at version 12.0.1 or earlier
Deactivate and remove the plugin until a vendor-released patched version is confirmed available and installed
Apply WAF rules to block SQL injection payloads targeting plugin endpoints
Rotate WordPress administrator passwords, API keys, and secrets stored in the database if exploitation is suspected

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to and including 12.0.1 as affected. Monitor the vendor's channels for a fixed release and upgrade immediately when available.

Workarounds

Disable the jnews-pay-writer plugin until a vendor patch is released
Restrict access to plugin endpoints at the web server or reverse proxy layer by IP allow-listing trusted sources
Enforce least privilege on the WordPress database user to limit the impact of a successful injection
Enable virtual patching through a managed WAF service such as Patchstack or Wordfence

bash

# Example nginx configuration to block requests containing common SQLi tokens
# targeting the vulnerable plugin path
location ~* /wp-content/plugins/jnews-pay-writer/ {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|;)") {
        return 403;
    }
}