Executive brief
The Ninja Tables WordPress plugin before version 5.2.17 allows unauthenticated users to execute arbitrary shortcodes on public pages by submitting form entries, provided the plugin is configured to use a form as the data source. An attacker can exploit this to inject malicious shortcodes that execute on the website, potentially breaking pages, stealing data, or gaining unauthorized access to site functionality.
Technical details
The vulnerability is an arbitrary shortcode injection in Ninja Tables that occurs when the plugin processes user-submitted form data without properly validating or restricting shortcode expansion. Unauthenticated users can inject shortcodes through form submission in a non-default configuration (using Fluent Forms as a data source), and these shortcodes are executed server-side when the table is rendered. The plugin fails to restrict shortcode execution to administrator-authored content, allowing persistent code execution.
Affected products
- WP Ninja Ninja Tables before 5.2.17
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Version 5.2.17 released