The Ninja Tables plugin contains a missing authorization check in the createFluentCartTable function, allowing any authenticated user with Subscriber-level access or higher to create arbitrary database tables. This can result in database pollution and – if the tables consume significant storage – resource exhaustion. The flaw is a missing authorization weakness, classified as CWE-862.

WordPress sites that use the Ninja Tables – Easy Data Table Builder plugin from techjewel. Versions up to and including 5.2.6 lack the necessary authorization checks and are therefore vulnerable.

The CVSS score of 4.3 indicates a moderate risk. EPSS information is not available and the vulnerability is not listed in CISA KEV, suggesting a lower likelihood of widespread exploitation. The likely attack vector is an authenticated HTTP request to the plugin’s createFluentCartTable endpoint, inferred from the code paths shown in the advisory. An attacker only needs a Subscriber or higher account to trigger table creation, which threatens database integrity and can consume storage.