CVE-2025-2940: Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2940?
CVE-2025-2940 is classified as a high-severity vulnerability due to its potential for Server-Side Request Forgery attacks.
How do I fix CVE-2025-2940?
To fix CVE-2025-2940, update the Ninja Tables – Easy Data Table Builder plugin to version 5.0.19 or later.
Who is affected by CVE-2025-2940?
All users of the Ninja Tables – Easy Data Table Builder plugin for WordPress running versions up to and including 5.0.18 are affected by CVE-2025-2940.
What type of attack is possible with CVE-2025-2940?
CVE-2025-2940 allows unauthenticated attackers to perform Server-Side Request Forgery attacks, potentially accessing sensitive internal resources.
What parameters are involved in CVE-2025-2940?
CVE-2025-2940 specifically exploits the args[url] parameter in the affected plugin.