What is the CVSS score of CVE-2026-65474?

CVE-2026-65474 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Ninja Tables CVE-2026-65474

EUVD-2026-48086 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-23 Patchstack

GHSA-9v3w-73cj-gwc3

WordPress Information Disclosure Ninja Tables Wordpress Plugin Wpmanageninja

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no interaction required yields limited confidentiality exposure and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:23 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.

Technical ContextAI

Ninja Tables (CPE: cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:*:*:*) is a WordPress plugin developed by WPManageNinja for building and displaying data tables on WordPress sites. CWE-497 describes a root cause where sensitive system or application information is inadvertently exposed to parties outside the intended trust boundary - in this case, to unauthenticated HTTP clients. The vulnerability likely arises from an improperly protected REST API endpoint or AJAX handler within the plugin that returns sensitive data (such as plugin configuration, table metadata, or user-associated data) without enforcing WordPress authentication or capability checks. WordPress plugins frequently register custom REST routes or wp_ajax_nopriv_ hooks that, if not properly guarded, are reachable by any unauthenticated visitor.

RemediationAI

The primary remediation is to upgrade the Ninja Tables plugin beyond version 5.2.10; the exact patched release version is not confirmed in available data, so administrators should install the latest available version from the WordPress plugin repository and verify it exceeds 5.2.10. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ninja-tables/vulnerability/wordpress-ninja-tables-plugin-5-2-10-sensitive-data-exposure-vulnerability should be consulted for the confirmed fix version when published. As a compensating control where immediate upgrade is not possible, administrators can temporarily deactivate the Ninja Tables plugin, accepting the trade-off of losing table rendering functionality site-wide. Alternatively, a Web Application Firewall (WAF) rule blocking unauthenticated requests to the specific vulnerable endpoint (if identified) can reduce exposure, though the exact endpoint path is not disclosed in current intelligence. Patchstack's virtual patching feature, if in use, may provide interim protection.