{
 "id": "WPSEC-2026-2982",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2982/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2982/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2982/index.md",
 "title": "Ninja Tables <= 5.5.0 - Authenticated (Administrator+) SQL Injection via Table Import",
 "description": "The Ninja Tables plugin for WordPress is vulnerable to SQL Injection via the row data of an imported Ninja Tables JSON file in all versions up to, and including, 5.5.0, due to the importer passing each row to $wpdb->insert() with the file's own keys, which are used as unescaped column names. This makes it possible for authenticated attackers with administrator-level access, such as site administrators on a multisite network, to inject SQL into the import query and extract sensitive information from the database.",
 "plugin": {
  "slug": "ninja-tables",
  "name": "Ninja Tables",
  "full_name": "Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables",
  "wordpress_org": "https://wordpress.org/plugins/ninja-tables/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-tables/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-tables"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.1",
 "remediation": "Update to 5.5.1 or later.",
 "fix_released": "2026-11-11T12:13:22+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:53.057654+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2982/",
  "https://plugins.svn.wordpress.org/ninja-tables/tags/5.5.1/",
  "https://wordpress.org/plugins/ninja-tables/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-tables",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}