CVE-2026-73533
CriticalCVSS 9.8Summary
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
Risk Assessment
An attacker can gain full control of the WordPress site, including administrative access and the ability to execute malicious code, even after the plugin is removed. This can lead to data theft, defacement, or using the server for further attacks.
Recommendation
Immediately check if you are using Ninja Tables Pro 5.2.11, and if so, scan the site for malicious files and administrator accounts. Remove malicious files and change all passwords, then install a clean version of the plugin from an official source.
Original NVD description (English source)
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.