CVE-2025-2939
Medium
Description
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
SeverityMedium
CVSS5.6
Exploit probability—
ProductWpmanageninja Ninja Tables
PublishedJun 3, 2025
First seenJun 3, 2025
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- wpmanageninja ninja_tables5.0.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpmanageninja ninja_tables | v < 5.0.19 | 5.0.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.