Summary
CVE-2026-73533 describes embedded malicious code found in Ninja Tables Pro version 5.2.11, a premium WordPress data-table plugin from WPManageNinja. The malicious code was introduced when a decommissioned update server was used to distribute a tampered build of the plugin, giving attackers a backdoor into any site that installed or updated to that version. The issue is rated CRITICAL, with a CVSS v4.0 base score of 9.3.
Technical details
- Root cause: a legacy update server, which should have been decommissioned after a prior migration, remained reachable through the vendor’s proxy routing and was used by an attacker to serve a tampered plugin build (CWE-506, Embedded Malicious Code).
- Trigger condition: a site installing or updating to Ninja Tables Pro 5.2.11 during the ~5-hour window (July 31, 2026, 14:00–19:00 UTC) that the tampered build was being served.
- Attack vector: Network — no interaction beyond installing/updating the affected plugin build is required for the backdoor to activate.
- Impact: the tampered build planted a rogue PHP file, stored a command-and-control address in the database, created a WordPress administrator account without password verification, registered a REST API namespace (wp-update/v1) for remote control, and installed scheduled tasks that re-establish access twice daily — persisting even after the plugin itself is removed.
Affected software
- WPManageNinja Ninja Tables Pro, version 5.2.11 only (obtained during the compromised distribution window on July 31, 2026).
Severity
- CVSS v3.1: 9.8 (CRITICAL) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0: 9.3 (CRITICAL) — AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: upgrade to Ninja Tables Pro 5.2.14 (the clean version released after the incident), which supersedes the compromised 5.2.11 build.
- If already running 5.2.11: do not simply upgrade — first check for the rogue PHP file, unexpected database entries referencing a command-and-control address, unauthorized administrator accounts, and malicious scheduled tasks, per the vendor’s cleanup guidance, then remove them, rotate all credentials, and review access logs before/after applying the clean update.

