Ninja Tables WordPress Plugin CVE-2026-2306

Exploitation requires: (1) WordPress site with Ninja Tables plugin version 5.2.6 or earlier installed and activated, (2) valid subscriber-level or higher WordPress user account (attacker-controlled or compromised), (3) plugin configuration that does not explicitly restrict subscriber access to the FluentCart module (default configuration is vulnerable), (4) network access to the WordPress installation's admin-ajax.php endpoint or REST API routes exposed by the plugin. Sites with closed registration (no public subscriber signup) or those that have manually restricted subscriber capabilities through role editors reduce exposure. The vulnerability does NOT require administrator or contributor privileges, social engineering, or user interaction - only basic WordPress authentication.

CVSS 4.3 with PR:L (low severity) appears inflated relative to real-world impact due to the integrity impact being limited to 'Low' and confidentiality/availability scored as 'None'. However, the actual risk is higher than CVSS suggests: resource exhaustion through database pollution can degrade site performance and cause denial of service, which should be classified as availability impact. The lack of authentication bypass (PR:L requirement) limits scope significantly - only sites where subscribers are granted plugin interaction are vulnerable. EPSS exploitation probability and KEV status are not provided; without these signals, the true exploitation frequency remains unknown. The attack vector is network-accessible but requires WordPress login credentials, making this a medium-privilege attack. The lack of user interaction (UI:N) is favorable for attackers. No public exploit code or active exploitation evidence is documented in the provided references, suggesting this may be a recent disclosure not yet widely weaponized. Real-world risk depends heavily on site configuration: sites with open registration and active subscriber bases face higher risk than enterprise deployments with restricted user creation.

An attacker registers a free subscriber account on a WordPress site running Ninja Tables 5.2.6. Using standard subscriber credentials, they make authenticated HTTP requests to the WordPress REST API or admin-ajax.php endpoint triggering the createFluentCartTable function repeatedly, creating thousands of malicious database tables with names like 'wp_fluentcart_spam_1', 'wp_fluentcart_spam_2', etc. Within hours, the database grows by gigabytes, database queries slow dramatically, and the WordPress site becomes unresponsive, achieving denial of service.