CVE-2026-2306 is a missing authorization vulnerability (CWE-862) in the Ninja Tables – Easy Data Table Builder WordPress plugin affecting all versions up to 5.2.6. The vulnerability exists because the createFluentCartTable function does not properly verify user permissions before allowing database table creation. Authenticated users with Subscriber-level privileges or higher can exploit this to create arbitrary tables in the database, potentially causing database pollution and resource exhaustion. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, and no user interaction required.

Exploitation allows authenticated users with low privileges (Subscriber or above) to create arbitrary database tables within the Ninja Tables plugin. This can lead to database pollution and resource exhaustion, which may degrade the performance of the affected WordPress site. There is no direct impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, minimizing the number of users with Subscriber-level or higher access. Monitor for unusual database activity related to Ninja Tables. Avoid granting unnecessary access to authenticated users.