Critical vulnerability in WPManageNinja Ninja Tables Pro affects version 5.2.11

## Overview CVE-2026-73533 is a critical vulnerability found in WPManageNinja Ninja Tables Pro version 5.2.11. The issue arises from a tampered plugin build served through a decommissioned update server. This vulnerability allows attackers to exploit an embedded malicious code. ## Technical Details The compromised build includes a rogue PHP file located at `app/Library/updater/NinjaTableDataSync.php`. This file establishes a backdoor REST API endpoint. Additionally, it drops persistent PHP files in the `mu-plugins` and `uploads` directories. The malicious code installs a passwordless administrator account and registers scheduled tasks that persist even after the plugin is removed. ## Impact The vulnerability has a CVSS score of 9.3, indicating a high severity risk. Successful exploitation allows attackers to gain unauthorized access to the affected WordPress installations. They can manipulate data, execute arbitrary code, and maintain persistence within the system, posing a significant threat to the integrity and confidentiality of the affected sites. ## Mitigation Defenders should immediately update to the latest version of WPManageNinja Ninja Tables Pro to mitigate this vulnerability. Regularly audit plugin sources and ensure that updates are obtained from trusted channels. Implement security measures such as web application firewalls and monitoring for unusual activity to detect potential exploitation attempts.