CVE-2026-73533 affects Ninja Tables Pro 5.2.11, where a tampered plugin build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php). This file establishes a backdoor REST API endpoint, drops persistent PHP files in the mu-plugins and uploads directories, installs a passwordless administrator account, and registers scheduled tasks that survive plugin removal. The malicious code was introduced via a compromised plugin build served through a decommissioned update server. The vulnerability allows unauthenticated remote attackers to gain persistent administrative access and maintain persistence on the affected WordPress installation.

The vulnerability enables unauthenticated remote attackers to gain persistent administrative access by installing a passwordless administrator account. The backdoor REST API endpoint and persistent PHP files allow attackers to maintain control even after the plugin is removed, posing a severe risk of full site compromise and persistent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is provided by WPManageNinja, affected users should consider removing the compromised plugin version 5.2.11 and thoroughly auditing their WordPress installations for the presence of rogue PHP files, unauthorized administrator accounts, and scheduled tasks. Monitoring for unusual REST API activity and restoring from clean backups may be necessary.