The vulnerability exists in versions of the Ninja Tables WordPress plugin prior to 5.2.17. In a non‑default configuration the plugin does not limit the expansion of shortcodes to tables created by administrators. As a result, unauthenticated users can submit an ordinary form entry that triggers arbitrary shortcodes to be executed on a public page. Because the shortcodes can manipulate page content, this can permanently break the page. The weakness is a form of code injection (CWE‑74) and materially compromises the integrity and availability of the affected site.

The flaw affects the Ninja Tables plugin for WordPress, specifically all releases before version 5.2.17. The vendor is listed as Ninja Tables; no other vendor or product variants are noted.

The CVSS score of 5.6 indicates a moderate severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, which suggests no publicly known exploitation has been documented to date. However, the attack path is straightforward: a web request from any user can submit form data that spreads a shortcode across the public page. This lack of authentication and the simplicity of crafting the payload make exploitation likely in a malicious environment, though the real‑world exploit probability cannot be quantified from the available data.