CVE-2025-2939

Description

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.

PUBLISHED Reserved 2025-03-28 | Published 2025-06-03 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Timeline

Credits

Trương Hữu Phúc (truonghuuphuc) finder

References

www.wordfence.com/...-5dba-4c84-95f7-43420245c770?source=cve

plugins.trac.wordpress.org/...k/src/WPFluent/Http/Client.php

plugins.trac.wordpress.org/...k/src/WPFluent/Http/Client.php

plugins.trac.wordpress.org/...k/src/WPFluent/Http/Client.php

cve.org (CVE-2025-2939)

nvd.nist.gov (CVE-2025-2939)

Download JSON