Security Alert Summary
The Ninja Tables WordPress plugin before 5.2.17 can allow unauthenticated users to trigger arbitrary shortcode expansion on a public page when the plugin is configured outside its default settings. In that configuration, submitting a normal form entry may execute shortcodes and can permanently break the affected page.
CVE Details
- CVE ID:
CVE-2026-86612 - Affected component: Ninja Tables WordPress plugin
- Affected versions: Versions before 5.2.17
- Published: September 23, 2026 at 11:17:14 AM
- Last modified: September 23, 2026 at 11:17:14 AM
- CVSS v3.1: Base score 5.6, MEDIUM; vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Authentication / Privileges / User interaction: No authentication required; privileges required: NONE; user interaction: NONE; attack complexity: HIGH
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: LOW
- Weakness: CWE-74 (Improper Neutralization of Special Elements in Output)
Technical Details
The plugin does not restrict shortcode expansion to table rows authored by administrators. In a non-default configuration, the shortcode expansion logic can be triggered by unauthenticated form submissions on a public page. That allows arbitrary shortcodes to be executed in the context of the page and can lead to rendering failures that permanently break the page display.
The description indicates the issue stems from missing restrictions on which table rows may expand shortcodes rather than a flaw in a specific named function or REST endpoint. Because unauthenticated submissions can reach the shortcode expansion path under the affected configuration, the attack vector is network accessible but requires a non-default setup and higher attack complexity.
Impact is limited to the capabilities of executed shortcodes and the resulting page state: confidentiality, integrity, and availability impacts are all rated as low in the CVSS data, reflecting partial technical impact rather than full site compromise.
How This Could Impact Your Website
Consider a site where the owner manages content, an internal editor team maintains tables, and external contributors or contractors submit form entries. If the plugin is configured to allow shortcode expansion for non-admin-authored rows, an unauthenticated actor could submit a form that injects or triggers shortcodes on a public page. Practical consequences include broken public pages and limited exposure of data that shortcodes may output.
Even with low-rated confidentiality impact, information such as email addresses or other user-visible data exposed by shortcodes can increase the risk of targeted phishing or social engineering against staff or contractors. The problem is particularly relevant on sites that accept public form submissions and display submitted content via Ninja Tables.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can submit content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual form submissions or unexpected page changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
