CVE-2025-2940 Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery

What is CVE-2025-2940?

CVE-2025-2940 is a high-severity server-side request forgery vulnerability in techjewel Ninja Tables – Easy Data Table Builder, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Weakness: CWE-918

Which versions are affected by CVE-2025-2940?

It affects 1 product.

Products include Wpmanageninja Ninja Tables.

How do I fix CVE-2025-2940?

No fix has been published for CVE-2025-2940 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-2940 being exploited?

There is no known exploitation of CVE-2025-2940 in the wild and no public exploit code.

Other vulnerabilities in techjewel Ninja Tables – Easy Data Table Builder

• CVE-2024-7304 Cross-site scripting in Ninja Tables – Easy Data Table Builder Medium 6.4
• CVE-2024-12772 Ninja Tables < 5.0.17 - Admin+ Stored XSS Medium 6.1
• CVE-2022-47137 WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS) Medium 5.9
• CVE-2025-2939 Deserialization in Ninja Tables – Easy Data Table Builder Medium 5.6
• CVE-2024-23504 WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j48q-h4rm-wphj.