CVE-2025-2939

MEDIUM

Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-2939 has a selected CVSS score of 5.6 (medium).

Description

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 3, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Ninja Tables – Easy Data Table Builder

Browse techjewel / Ninja Tables – Easy Data Table Builder

Default status: unaffected

CVE ListThrough 5.0.18affected

References

5