CVE-2025-2939: Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2939?
CVE-2025-2939 is considered a high severity vulnerability due to its potential for PHP Object Injection that allows unauthenticated attackers to manipulate server-side objects.
How do I fix CVE-2025-2939?
To fix CVE-2025-2939, update the Ninja Tables – Easy Data Table Builder plugin to version 5.0.19 or later, where the vulnerability has been patched.
Who is affected by CVE-2025-2939?
All users of the Ninja Tables – Easy Data Table Builder plugin for WordPress versions up to and including 5.0.18 are affected by CVE-2025-2939.
Can CVE-2025-2939 be exploited without authentication?
Yes, CVE-2025-2939 can be exploited by unauthenticated attackers, making it particularly dangerous.
What kind of attack could result from CVE-2025-2939?
CVE-2025-2939 could lead to remote code execution or data leak through PHP Object Injection.