PT-2026-37343 · WordPress · Ninja Tables

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-2306

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ninja Tables – Easy Data Table Builder versions prior to 5.2.7

Description The plugin is susceptible to unauthorized database table creation because of missing authorization checks in the createFluentCartTable() function. Authenticated attackers with Subscriber-level access or higher can create arbitrary tables in the database, potentially resulting in resource exhaustion and database pollution.

Recommendations Update the plugin to a version later than 5.2.6. As a temporary workaround, restrict access to the createFluentCartTable() function to prevent unauthorized users from triggering it.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2306

Affected Products

Ninja Tables

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-2306 · Security Note
• https://twitter.com/VulmonFeeds/status/2051923387597860880 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.2.6/app/Modules/FluentCart/Handlers/FluentCartHandler.php#L44 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3453522%40ninja-tables%2Ftrunk&old=3447894%40ninja-tables%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2051928701592609215 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/592d42eb-4025-44af-a519-672656ad8b0e?source=cve · Note
• https://t.me/cveNotify/162287 · Telegram Post
• https://t.me/CVEtracker/52816 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/app/Modules/FluentCart/FluentCartModule.php#L23 · Note
• https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.2.6/app/Modules/FluentCart/FluentCartModule.php#L23 · Note
• https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/app/Modules/FluentCart/Handlers/FluentCartHandler.php#L44 · Note
• https://twitter.com/infoflowcloud/status/2051930071422652745 · Twitter Post