CVE-2026-86612
Received Received - Intake

Unauthenticated Shortcode Execution in Ninja Tables Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86612
EUVD
EUVD-2026-85190

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpmet ninja_tables to 5.2.17 (exc)
wpmet table to 5.2.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Ninja Tables WordPress plugin before version 5.2.17 allows unauthenticated users to execute arbitrary shortcodes on public pages by submitting a form entry. The plugin fails to restrict shortcode expansion to administrator-authored content in certain configurations, enabling attackers to permanently break pages.

Detection Guidance

Check if the Ninja Tables WordPress plugin version is below 5.2.17. Inspect public pages for unexpected shortcode execution or broken content. Review form entries for suspicious shortcodes.

Impact Analysis

An attacker could exploit this to execute malicious shortcodes, leading to unauthorized actions, data breaches, or denial of service by breaking public pages. It may also allow defacement or injection of harmful content without authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Update the Ninja Tables plugin to version 5.2.17 or later immediately. Disable the plugin if an update is not possible. Monitor public pages for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart