A tampered build of the Ninja Tables Pro WordPress plugin, distributed through a decommissioned update server, carried malicious code that installed a persistent backdoor on affected sites.
What Is It
CVE-2026-73533 is an embedded malicious code flaw (CWE-506) in Ninja Tables Pro 5.2.11 from WPManageNinja. The vulnerability was not a coding mistake; it was a supply chain compromise. A tampered plugin build was served through a decommissioned update server, so site operators who pulled 5.2.11 from that server during the exposure window would have received the malicious package rather than a legitimate build. Neither the NVD record nor the vendor notice quantifies how many sites updated through that path.
The tampered build added a rogue PHP file at app/Library/updater/NinjaTableDataSync.php. That file:
- Established a backdoor REST API endpoint
- Dropped persistent PHP files into the
mu-pluginsanduploadsdirectories - Installed a passwordless administrator account
- Registered scheduled tasks that survived plugin removal
Why It Matters
VulnCheck rates this CVSS 3.1 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 9.3 (CRITICAL). It is remotely reachable over the network, requires no privileges, no user interaction, and no special attack conditions, with high impact to confidentiality, integrity, and availability.
The persistence design is the real problem. Uninstalling the plugin does not clean the site: the mu-plugins drops, the uploads-directory PHP files, the passwordless admin account, and the scheduled tasks all remain. Any site that installed 5.2.11 from the tampered source should be treated as fully compromised rather than simply in need of an update.
What's Vulnerable
- Vendor: WPManageNinja
- Product: Ninja Tables Pro
- Affected version: 5.2.11
No CPE match data is published in the NVD record at this time.
Patch Status
The NVD record was published 2026-08-13 with a status of "Received," and does not list a fixed version or a specific remediation action. WPManageNinja has published a security incident notice dated 31 July 2026; operators should consult that advisory and the VulnCheck advisory for vendor guidance.
CVE-2026-73533 is absent from the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.08.11 (released 2026-08-11), the most recent release published at the time of writing. That release predates the CVE's 2026-08-13 NVD publication, so the absence reflects a catalog that had not yet had an opportunity to cover this identifier rather than a CISA determination about exploitation. There is currently no KEV-backed confirmation of active exploitation and no federal remediation deadline; operators tracking BOD 22-01 obligations should re-check the catalog directly rather than treat this as settled.
Sources
- NVD, CVE-2026-73533 (source: [email protected]), published 2026-08-13
- VulnCheck Advisory; Ninja Tables Pro Embedded Malicious Code via Tampered Plugin Build
- WPManageNinja; Security Incident on 31 July 2026
- WordPress.org; Ninja Tables Plugin
- CISA, Known Exploited Vulnerabilities Catalog (checked against catalog version 2026.08.11)