Ninja Tables – Best Data Table Plugin for WordPress, CVE-2025-2939
- CVE, Research URL
- Published on
- Jun 03, 2025
- Research Description
- The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
- Affected versions
-
max 5.0.19.
- Status
-
vulnerable