A flaw in the Ninja Tables plugin allows the insertion of sensitive information into outgoing data and the retrieval of embedded sensitive data. The vulnerability enables an attacker to expose confidential data and was classified as CWE‑201 Sensitive Data Exposure. It permits the compromising of information confidentiality but does not provide remote code execution or denial of service.

WordPress installations that use the Ninja Tables plugin, developed by Shahjahan Jewel, version 5.2.5 or earlier are affected. The flaw applies to all releases from the earliest available version through 5.2.5.

The overall CVSS score is 4.3, indicating moderate risk. The EPSS value is below 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not specified in the description; however, it is inferred that the flaw can be triggered via HTTP requests to the plugin’s endpoints, potentially by anyone who can access the site or by authenticated administrators. The impact is limited to data confidentiality, and there are no known privileges or access control weaknesses beyond those required to exploit the plugin.