CVE-2025-2940 is a Server-Side Request Forgery (SSRF) vulnerability in the Ninja Tables – Easy Data Table Builder WordPress plugin, affecting all versions up to 5.0.18. The vulnerability arises from insufficient validation of the args[url] parameter, allowing unauthenticated attackers to cause the server to make arbitrary HTTP requests. This can be leveraged to interact with internal network services or modify information accessible from the server context. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity but no availability impact. The vulnerability is publicly known and published but no patch or official fix details are currently available.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This may allow the attacker to access sensitive internal resources or modify data accessible via these requests, impacting confidentiality and integrity of information. There is no direct impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or filtering incoming requests that include the args[url] parameter or limit the server's ability to make outbound HTTP requests to untrusted destinations. Monitor vendor channels for updates and apply patches promptly once released.