Description

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T16:19:05.620Z",
  "pubdate": "2026-08-13T16:19:05.620Z",
  "executiveSummary": "Ninja Tables Pro version 5.2.11 is affected by an embedded malicious code vulnerability resulting from a compromised plugin build distributed through a decommissioned update server. This supply chain compromise introduces a rogue PHP file capable of establishing an unauthorized REST API backdoor, executing persistent file droppings, and creating a passwordless administrative account.\nThe impact of this vulnerability is critical, granting unauthorized remote attackers complete administrative control over affected WordPress installations. The rogue implementation ensures persistence by dropping malicious payloads into the mu-plugins and uploads directories, as well as registering scheduled tasks that remain active even after the initial plugin is uninstalled.\nAffected systems comprise WordPress instances utilizing the compromised Ninja Tables Pro 5.2.11 build. Risk implications include total compromise of confidentiality, integrity, and availability of the underlying web server and database.\nAttacker capabilities include arbitrary code execution, privilege escalation via backdoor administrator account creation, and long-term persistence mechanisms designed to survive standard plugin removal procedures. Exploitation requires the targeted system to retrieve and install the tampered plugin build sourced from the compromised update infrastructure.",
  "technicalDetails": "The vulnerability stems from a supply chain compromise where a tampered plugin build of Ninja Tables Pro version 5.2.11 was served to administrators via a decommissioned update server. The primary vulnerable component is the injected rogue PHP file located at app/Library/updater/NinjaTableDataSync.php.\nThe attack flow initiates when the malicious update is retrieved and installed on the WordPress target. Upon execution, the NinjaTableDataSync.php script establishes an unauthorized REST API backdoor endpoint exposed via standard HTTP/HTTPS protocols. This endpoint allows remote unauthenticated or privileged attackers to interface with the compromised environment.\nPost-exploitation payload behavior involves several automated persistence and escalation steps. First, the backdoor drops persistent PHP files into the mu-plugins (Must-Use plugins) directory and uploads directory, ensuring code execution on every subsequent WordPress bootstrap cycle. Second, the script provisions a passwordless administrator account within the WordPress database, enabling direct authentication bypassing standard credential checks.\nFinally, the rogue implementation registers automated scheduled tasks via the WordPress cron system or native OS mechanisms. These scheduled tasks monitor the environment and re-establish dropped files if removal attempts are made, guaranteeing that the backdoor survives the complete removal or uninstallation of the parent Ninja Tables Pro plugin.\nNetwork exposure is defined by the web-accessible REST API endpoint exposed by the WordPress installation. Authentication requirements for triggering the secondary payloads are bypassed entirely through the establishment of the passwordless administrator account and backdoor routing logic."
}