Vulnerability details
CVE-2026-73533
wpmanageninja Ninja Tables Pro
Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
CVSS 4.0
9.3Critical
Official description
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| wpmanageninja | Ninja Tables Pro | 5.2.11 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://wpmanageninja.com/security-incident-on-31-july-2026/ technical-description
- https://wordpress.org/plugins/ninja-tables/ product
- https://www.vulncheck.com/advisories/ninja-tables-pro-embedded-malicious-code-via-tampered-plugin-build third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-13
- Last updated
- 2026-08-17
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.64%
Probability of exploitation in 30 days
51.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-506Embedded Malicious Code