jnews-pay-writer contains improper handling of filenames in an include/require statement, allowing a local file inclusion flaw. An attacker can trick the plugin into reading or executing arbitrary files on the server, potentially exposing sensitive data or running malicious code. The weakness is noted as CWE‑98 and can lead to confidentiality, integrity, or availability compromise depending on what files are accessed.

The vulnerability affects Jegtheme's JNews – Pay Writer plugin up to and including version 11.0.0. Users running this plugin or earlier versions are exposed.

The CVSS score of 7.5 indicates a high severity LFI risk, while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves supplying a crafted parameter that the plugin evaluates without proper validation, which may be possible over an unauthenticated web request if the vulnerable endpoint is publicly accessible. Overall risk remains elevated until the vendor releases a fix.