What the vulnerability does
01Description
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
Explanation of Vulnerability in Simple Terms
02Summary
Ninja Tables versions up to 5.0.18 contain a deserialization vulnerability in how the plugin processes untrusted data. An attacker can craft malicious input that, when processed by the plugin, leads to unintended code execution or data manipulation. The attack requires specific conditions to succeed but does not require authentication or user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify table content, or execute code on the site by sending a specially crafted request.
Potential impact on your site
04Site Impact
Attackers could read or alter table data, or potentially run code on your site without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication required, but attack complexity is high.
Key dates
06Disclosure timeline
June 3, 2025
CVE published
April 8, 2026
Record updated
