CVE-2026-73533 affects Ninja Tables Pro version 5.2.11, where a tampered plugin build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php). This file establishes a backdoor REST API endpoint, drops persistent PHP files in the mu-plugins and uploads directories, installs a passwordless administrator account, and registers scheduled tasks that survive plugin removal. The malicious code was introduced via a compromised update server that is now decommissioned. The vulnerability allows unauthenticated remote attackers to gain persistent administrative access and maintain long-term control over the affected WordPress installation.

The vulnerability allows unauthenticated remote attackers to execute malicious code, establish persistent backdoors, create passwordless administrator accounts, and maintain persistence through scheduled tasks even after plugin removal. This results in full compromise of the affected WordPress site, including potential data theft, site defacement, or further malware deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the tampered build was distributed via a decommissioned update server, users should verify the integrity of their plugin installation. Immediate mitigation includes removing the affected version 5.2.11 and scanning for and removing any rogue PHP files, unauthorized administrator accounts, and scheduled tasks. Monitor official WPManageNinja advisories for updates or patches addressing this issue.