CVE-2026-73533 WPManageNinja CVE debrief

Who should care

Defenders of WordPress installations using Ninja Tables Pro 5.2.11 should verify and remediate potential backdoor installations. This includes administrators, security teams, and incident response personnel.

Why it matters

CVE-2026-73533 is a critical vulnerability in Ninja Tables Pro 5.2.11 that allows for backdoor installation and administrator account creation. Defenders should verify and remediate potential backdoor installations, especially in WordPress installations using the affected plugin version.

• Potential backdoor installation requiring verification and remediation
• Creation of passwordless administrator accounts requiring immediate attention
• Dropped persistent PHP files in mu-plugins and uploads directories requiring cleanup
• Registered scheduled tasks surviving plugin removal requiring manual intervention

Technical summary

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file that established a backdoor REST API endpoint, dropped persistent PHP files, installed a passwordless administrator account, and registered scheduled tasks. The vulnerability allows for backdoor installation and administrator account creation. Defenders should verify and remediate potential backdoor installations, especially in WordPress installations using the affected plugin version.

Defensive priority

High priority for defenders of WordPress installations using Ninja Tables Pro 5.2.11 to verify and remediate potential backdoor installations.

Recommended defensive actions

• Verify Ninja Tables Pro version and check for signs of tampering
• Remove and reinstall Ninja Tables Pro from a trusted source
• Check for and remove rogue PHP files, especially in mu-plugins and uploads directories
• Verify and reset administrator account credentials
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry detail a critical vulnerability in Ninja Tables Pro 5.2.11, where a tampered plugin build introduced a backdoor REST API endpoint and installed a passwordless administrator account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.