What is the CVSS score of CVE-2026-2306?

CVE-2026-2306 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Ninja Tables WordPress Plugin CVE-2026-2306

EUVD-2026-27524 MEDIUM

Missing Authorization (CWE-862)

2026-05-06 Wordfence

GHSA-c34c-82p7-x3p9

WordPress Authentication Bypass Denial Of Service Wordpress Plugin Ninja Tables Easy Data Table Builder Techjewel

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 06:00 vuln.today

DescriptionCVE.org

The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the createFluentCartTable function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary Ninja Tables in the database which can lead to database pollution and resource exhaustion.

AnalysisAI

Authenticated subscribers can create arbitrary database tables in WordPress installations running Ninja Tables plugin version 5.2.6 and earlier via missing authorization checks on the createFluentCartTable function. This allows low-privileged users to pollute the database and cause resource exhaustion without requiring administrative access, affecting any site where subscribers have plugin interaction permissions.

Technical ContextAI

The Ninja Tables plugin for WordPress integrates a FluentCart module that exposes a createFluentCartTable function without proper authorization verification. The vulnerability exists in the FluentCartHandler.php and FluentCartModule.php files, where the function fails to validate user capabilities before executing database table creation operations. CWE-862 (Missing Authorization) indicates the root cause: the application performs a privileged action (arbitrary table creation in the WordPress database) without checking whether the user has permission to perform that action. While the CVSS vector shows network accessibility and low complexity, the PR:L requirement means WordPress authentication is necessary, but subscriber-level roles (the lowest authenticated user tier in WordPress) should not have database table creation capabilities.

RemediationAI

Upgrade Ninja Tables to version 5.2.7 or later, which includes authorization checks on the createFluentCartTable function as confirmed by the repository changeset 3453522. Administrators should immediately update the plugin via WordPress admin dashboard under Plugins > Installed Plugins or via WP-CLI using 'wp plugin update ninja-tables'. For sites unable to update immediately, restrict subscriber-level user creation and audit existing subscribers to identify potentially unauthorized accounts that could exploit this vulnerability. Disable the FluentCart integration module in plugin settings if the feature is not actively used. Review database audit logs for unauthorized table creation since the plugin installation date. The Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/592d42eb-4025-44af-a519-672656ad8b0e?source=cve contains additional indicators and recommended detection rules.