Ninja Tables – Easy Data Table Builder: Server-side request forgery
Ninja Tables – Easy Data Table Builder is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.
- Component
- Ninja Tables – Easy Data Table Builder
- Plugin slug
ninja-tables- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Jun 27, 2025
This CVE was published Jun 27, 2025 and is one of 15 known issues for this plugin.
Patch or disable the affected component.
Update Ninja Tables – Easy Data Table Builder to a release outside the affected range, or disable and remove it until a fixed version is available.
Technical description
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N