PHP Object Injection in Ninja Tables Plugin by WordPress

CVE-2025-2939

What is CVE-2025-2939?

The Ninja Tables plugin for WordPress is susceptible to PHP Object Injection due to improper deserialization of untrusted input from the args[callback] parameter. This vulnerability affects all versions up to and including 5.0.18. It enables unauthenticated attackers to inject a PHP Object, potentially executing arbitrary functions. However, the attack is somewhat constrained as it allows only single function calls without user-supplied parameters, limiting the potential impact.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References