Ninja Tables – Easy Data Table Builder <= 5.0.18 - Falsificación de Solicitud del Servidor No Autenticada (Server-Side Request Forgery)

The SSRF vulnerability in Ninja Tables allows an attacker to craft malicious requests through the args[url] parameter. Successful exploitation enables an attacker to query and potentially modify data from internal services that the WordPress instance can access. This could include accessing administrative panels, databases, or other sensitive resources behind the firewall. The lack of authentication required significantly broadens the attack surface, as any external user can trigger the vulnerability. While direct data exfiltration might be challenging without further vulnerabilities, the ability to probe internal services and potentially discover other weaknesses represents a significant risk.

WordPress websites utilizing the Ninja Tables plugin, particularly those hosting sensitive internal services or data, are at risk. Shared hosting environments where multiple users share the same server are also at increased risk, as a compromised Ninja Tables instance could potentially be used to attack other sites on the same server.

• wordpress / plugin:

grep -r 'args[url]' /var/www/html/wp-content/plugins/ninja-tables/*

• wordpress / plugin:

wp plugin list --status=all | grep 'ninja-tables'

• wordpress / plugin:

wp plugin update ninja-tables --version=5.0.19

• generic web:

curl -I 'http://your-wordpress-site.com/wp-admin/admin-ajax.php?action=ninja_tables_load_table&args[url]=http://internal-service.local'

1. 2025-06-27Disclosure

   disclosure

1. Reservado2025-03-28
2. Publicada2025-06-27
3. Modificada2026-04-08
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-2940 is to immediately upgrade the Ninja Tables plugin to version 5.0.19 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious URLs in the args[url] parameter. Specifically, look for patterns indicative of internal network addresses or sensitive service endpoints. Additionally, restrict the plugin's access to internal resources by implementing network segmentation and access control lists (ACLs). After upgrading, verify the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and confirming that the request is blocked or handled safely.

Instalaciones activas

80KConocido

Valoración del plugin