Ninja Tables Pro CVE-2026-73533

Exploitation requires that the victim installed the specific tampered Ninja Tables Pro 5.2.11 build delivered from the decommissioned vendor update server during the compromise window - the legitimate build is not affected, so this is the primary limiting factor. Once the tampered build is present, no further special conditions apply: the backdoor exposes an unauthenticated REST API endpoint and a passwordless administrator account reachable over the network (AV:N/PR:N/UI:N), so an attacker needs no credentials, no user interaction, and no non-default WordPress configuration to reach it. The main defensive discriminator is provenance of the plugin build, not runtime configuration; sites that only ever used official untampered builds are not exposed.

This is a high-priority, real-world risk rather than a theoretical high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) reflects that the planted backdoor is remotely reachable over the network with no authentication or user interaction and yields full confidentiality, integrity, and availability impact - consistent with a live backdoor. The key mitigating signal is scope of distribution: only sites that installed the specific tampered 5.2.11 build served from the decommissioned update server during the compromise window are affected, so this is targeted/scoped rather than universal. No EPSS score was provided and there is no CISA KEV listing, so widespread automated exploitation is not confirmed; however, because the payload is malware pre-installed on victim sites, 'exploitation' does not require any external exploit development. The absence of KEV should not be read as low risk - it more likely reflects that the incident is vendor-disclosed and recent. Anyone who ran the tampered build should assume compromise.

A site administrator updated or installed Ninja Tables Pro 5.2.11 while the vendor's now-decommissioned update server was serving the tampered build, silently installing the backdoor. An attacker then sends an unauthenticated request to the rogue REST API endpoint (or logs in via the planted passwordless admin account) to execute PHP, exfiltrate the database, and maintain persistence through mu-plugins and cron even after the plugin is removed. No separate public exploit tool is required because the malicious capability is embedded in the distributed code.