Ninja Tables Pro Backdoor via Malicious Update

Executive Summary

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the rogue PHP file at app/Library/updater/NinjaTableDataSync.php and scan for unexpected files in mu-plugins and uploads directories. Look for a passwordless administrator account and scheduled tasks that may have been created by the backdoor.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to your WordPress site, create persistent backdoors even after plugin removal, install a passwordless admin account, and execute arbitrary code. It compromises site integrity, confidentiality, and availability, enabling full control over your WordPress installation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access, potential data exfiltration, and lack of integrity controls. It could lead to data breaches, unauthorized modifications, and failure to maintain secure processing environments as required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately remove the Ninja Tables Pro plugin, delete the identified rogue files, revoke any unauthorized administrator accounts, and audit scheduled tasks. Consider restoring from a clean backup if compromise is suspected.

Useful 0 Not Useful 0