PHP Object Injection in Ninja Tables Plugin by WordPress
CVE-2025-2939
5.6MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 June 2025
What is CVE-2025-2939?
The Ninja Tables plugin for WordPress is susceptible to PHP Object Injection due to improper deserialization of untrusted input from the args[callback] parameter. This vulnerability affects all versions up to and including 5.0.18. It enables unauthenticated attackers to inject a PHP Object, potentially executing arbitrary functions. However, the attack is somewhat constrained as it allows only single function calls without user-supplied parameters, limiting the potential impact.
Affected Version(s)
Ninja Tables – Easy Data Table Builder * <= 5.0.18