CVE-2026-2306

MEDIUM

Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-2306 has a selected CVSS score of 4.3 (medium).

Description

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the `createFluentCartTable` function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary Ninja Tables in the database which can lead to database pollution and resource exhaustion.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 6, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Ninja Tables – Easy Data Table Builder

Browse techjewel / Ninja Tables – Easy Data Table Builder

Default status: unaffected

CVE ListThrough 5.2.6affected

References

7