CVE-2026-86612 — Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

CVE-2026-86612

Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source PUBLISHED

Description (CNA)

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.

Affected (CNA)

Vendor / product	Versions
Unknown / Ninja Tables	affected 0 before 5.2.17

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4be7a5e0-9657-4692-904d-b696224e32ec/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.