CVE-2025-2939 is a deserialization of untrusted data vulnerability (CWE-502) in the Ninja Tables – Easy Data Table Builder WordPress plugin up to version 5.0.18. It arises from unsafe deserialization of the args[callback] parameter, allowing unauthenticated PHP Object Injection. The presence of a POP chain permits attackers to execute arbitrary functions without user-supplied parameters, limiting the scope of exploitation. The vulnerability is network exploitable without privileges or user interaction, but requires high attack complexity.

An unauthenticated attacker can inject PHP objects via deserialization, potentially leading to execution of arbitrary functions. However, the inability to supply parameters to these functions limits the impact. The vulnerability affects confidentiality, integrity, and availability to a limited extent, consistent with the medium CVSS score of 5.6. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin to mitigate risk.