CVE-2025-2939: Ninja Tables WordPress Plugin RCE Flaw

CVE-2025-2939 Overview

CVE-2025-2939 affects the Ninja Tables – Easy Data Table Builder plugin for WordPress in all versions up to and including 5.0.18. The vulnerability stems from insecure deserialization of untrusted input passed through the args[callback] parameter. Unauthenticated attackers can inject arbitrary PHP objects into the application. A Property-Oriented Programming (POP) chain present in the plugin enables execution of arbitrary single functions, though attackers cannot supply parameters to those functions. The issue is tracked as CWE-502: Deserialization of Untrusted Data and impacts sites running the affected plugin versions.

Critical Impact
Unauthenticated PHP Object Injection can be exploited over the network without user interaction, potentially enabling arbitrary function calls through the plugin's POP chain.

Affected Products

Ninja Tables – Easy Data Table Builder plugin for WordPress, all versions up to and including 5.0.18
Vendor: wpmanageninja
Component path: vendor/wpfluent/framework/src/WPFluent/Http/Client.php

Discovery Timeline

2025-06-03 - CVE-2025-2939 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2939

Vulnerability Analysis

The Ninja Tables plugin passes attacker-controllable input into a PHP deserialization routine within the bundled wpfluent HTTP client framework. When the args[callback] parameter is processed, the plugin invokes unserialize() on data originating from an untrusted source. This behavior allows an unauthenticated remote attacker to instantiate arbitrary PHP objects inside the running application.

Because the plugin ships alongside classes with __destruct, __wakeup, or similar magic methods, an attacker can construct a POP (Property-Oriented Programming) chain to trigger code paths that were never intended to receive external input. The advisory notes that the available gadget chain only permits calling single functions and does not accept attacker-supplied arguments, which reduces the practical impact but does not eliminate the risk.

Root Cause

The root cause is the use of PHP's native unserialize() on data reachable from HTTP request parameters. Deserialization occurs before any validation of the payload's structure or origin, violating the principle that only trusted, integrity-protected data should be deserialized. The vulnerable code resides in the plugin's HTTP client component within the vendored wpfluent framework.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends a crafted HTTP request that reaches an endpoint invoking the vulnerable args[callback] handling logic. The serialized payload contains a chain of PHP object references that, upon deserialization, triggers gadget methods leading to function invocation. Attack complexity is elevated because the attacker must locate a usable POP chain and account for the constraint that no arguments can be passed to invoked functions. See the Wordfence Vulnerability Analysis and the affected WordPress Plugin Code Reference for the specific sink at line 399.

Detection Methods for CVE-2025-2939

Indicators of Compromise

HTTP requests to WordPress endpoints containing an args[callback] parameter whose value begins with serialized PHP markers such as O: (object), a: (array), or s: (string).
Unexpected PHP error log entries referencing unserialize(), __wakeup, or __destruct inside wp-content/plugins/ninja-tables/vendor/wpfluent/.
Outbound network connections or file writes originating from the PHP worker process shortly after requests targeting Ninja Tables endpoints.

Detection Strategies

Inspect web server and WAF logs for POST or GET parameters named callback under any args[...] array containing serialized PHP object signatures.
Enable PHP error logging and alert on unserialize() warnings originating from the Ninja Tables plugin path.
Correlate WordPress access logs with anomalous PHP process behavior such as unexpected file modifications under wp-content/.

Monitoring Recommendations

Deploy WAF rules that block request parameters containing PHP serialization patterns (O:[0-9]+:") targeting WordPress admin-ajax and REST endpoints.
Monitor plugin version inventory across managed WordPress sites and flag any installation of Ninja Tables at or below version 5.0.18.
Enable file integrity monitoring on the wp-content/plugins/ninja-tables/ directory to detect tampering.

How to Mitigate CVE-2025-2939

Immediate Actions Required

Update the Ninja Tables – Easy Data Table Builder plugin to version 5.0.19 or later on all WordPress instances.
Audit WordPress plugin inventories to confirm no site remains on version 5.0.18 or earlier.
Review recent web access logs for requests containing the args[callback] parameter with serialized payloads.

Patch Information

The vendor released a fix in Ninja Tables version 5.0.19. Compare the vulnerable sink at tag 5.0.18, Client.php line 399 with the corresponding code in tag 5.0.19 for details on the fix. Additional context is available in the Wordfence Vulnerability Analysis.

Workarounds

If patching cannot be performed immediately, deactivate the Ninja Tables plugin until the update is applied.
Configure WAF or reverse proxy rules to block requests where any parameter value matches PHP serialization signatures such as ^O:\d+:" or ^a:\d+:{.
Restrict access to WordPress AJAX and REST endpoints to authenticated users where feasible to reduce attack surface.

bash

# Example ModSecurity rule to block PHP object serialization payloads targeting Ninja Tables
SecRule ARGS_NAMES "@rx callback" \
    "chain,phase:2,deny,status:403,id:1002939,\
    msg:'CVE-2025-2939 Ninja Tables PHP Object Injection attempt'"
    SecRule ARGS "@rx ^(O|a|s):[0-9]+:" "t:none"