CVE-2025-2940: SSRF in Ninja Tables – Easy Data Table Builder

The SSRF vulnerability in Ninja Tables allows an attacker to craft malicious requests through the args[url] parameter. Successful exploitation enables an attacker to query and potentially modify data from internal services that the WordPress instance can access. This could include accessing administrative panels, databases, or other sensitive resources behind the firewall. The lack of authentication required significantly broadens the attack surface, as any external user can trigger the vulnerability. While direct data exfiltration might be challenging without further vulnerabilities, the ability to probe internal services and potentially discover other weaknesses represents a significant risk.

1. Reserved2025-03-28
2. Published2025-06-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-2940 is to immediately upgrade the Ninja Tables plugin to version 5.0.19 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious URLs in the args[url] parameter. Specifically, look for patterns indicative of internal network addresses or sensitive service endpoints. Additionally, restrict the plugin's access to internal resources by implementing network segmentation and access control lists (ACLs). After upgrading, verify the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and confirming that the request is blocked or handled safely.

Active installs

80KKnown

Plugin rating