CVE-2026-2306: Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the createFluentCartTable function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary Ninja Tables in the database which can lead to database pollution and resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2306?
CVE-2026-2306 has a high severity due to its potential for unauthorized database table creation.
How do I fix CVE-2026-2306?
To fix CVE-2026-2306, update the Ninja Tables plugin to version 5.2.7 or later.
What versions are affected by CVE-2026-2306?
CVE-2026-2306 affects Ninja Tables versions up to and including 5.2.6.
What type of attack can exploit CVE-2026-2306?
CVE-2026-2306 can be exploited to allow authenticated users to create arbitrary database tables.
Is user authentication required to exploit CVE-2026-2306?
Yes, an authenticated user with Subscriber+ privileges can exploit CVE-2026-2306.