Server-Side Request Forgery in Ninja Tables Plugin for WordPress
CVE-2025-2940

7.2HIGH

Key Information:

Vendor

WordPress
Status
Ninja Tables – Easy Data Table Builder
Vendor
CVE Published:
27 June 2025

What is CVE-2025-2940?

The Ninja Tables plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF), affecting all versions up to and including 5.0.18. This vulnerability allows unauthenticated attackers to exploit the args[url] parameter, facilitating unauthorized web requests to remote locations. By leveraging this flaw, attackers can potentially query and modify sensitive information from internal services of the web application, posing significant risks to data security and integrity.

Affected Version(s)

Ninja Tables – Easy Data Table Builder * <= 5.0.18

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ninja-tables/t...
https://plugins.trac.wordpress.org/browser/ninja-tables/t...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc)
.
CVE-2025-2940 : Server-Side Request Forgery in Ninja Tables Plugin for WordPress