The vulnerability exists in the Ninja Tables – Easy Data Table Builder WordPress plugin up through version 5.0.18. An attacker can supply untrusted data in the args[callback] parameter, causing the plugin to deserialize PHP objects without proper validation. The deserialization flaw enables PHP Object Injection, which, combined with a pre‑existing POP chain, allows the execution of arbitrary PHP functions. Although the effect is limited to a handful of functions and does not provide user‑supplied parameters, the ability to run code remotely satisfies the definition of Remote Code Execution.

This flaw affects the plugin Ninja Tables – Easy Data Table Builder distributed by Techjewel for WordPress. Any WordPress installation running the plugin at version 5.0.18 or earlier is susceptible.

The CVSS score of 5.6 classifies the vulnerability as moderate severity. The EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no publicly reported exploit yet. Attackers could exploit the flaw by sending a crafted HTTP request containing the malicious args[callback] payload to any public WordPress site that hosts the vulnerable plugin. The lack of authenticated prerequisites means the attack vector is open to anyone with network access to the target.