Cross‑site request forgery in jegtheme's JNews Paywall plugin for WordPress permits an attacker to induce an authenticated site user to perform unauthorized actions, such as altering content or adjusting settings. The vulnerability stems from insufficient validation of incoming requests, allowing maliciously crafted submissions to be executed as if submitted by the legitimate user. This can compromise the integrity and availability of site content and configuration.

The flaw impacts jegtheme’s JNews Paywall plugin on all WordPress installations running any version earlier than 12.0.1. Site administrators should verify the installed plugin version and identify whether the installation remains within the vulnerable range.

The CVSS base score of 4.3 reflects a moderate risk that requires user interaction. The EPSS score of less than 1 percent indicates a low probability of mass exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers typically need to draw a logged‑in user or a visitor who can be sent a crafted request; based on the description, it is inferred that the vulnerability requires an authenticated user, and such requests may be transmitted via a malicious hyperlink or embedded form that persuades the browser to submit the forged data.