Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.3.
Published: 2025-12-09
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of special elements in an SQL command (SQL Injection, CWE-89). A remote attacker can inject malicious SQL through input fields processed by the Ninja Tables plugin, potentially gaining unauthorized read or write access to the database, extracting sensitive data, or altering site content.

Affected Systems

The affected product is the Ninja Tables WordPress plugin by Shahjahan Jewel. Versions up to and including 5.2.3 are vulnerable; all earlier releases are also in scope.

Risk and Exploitability

This issue carries a CVSS score of 7.6, indicating a high impact but requires active exploitation. The EPSS score is below 1%, showing a low probability of exploitation observed to date, and it is not listed in the CISA KEV catalog. Because the plugin is part of a web application, the likely attack vector involves sending crafted requests to the plugin’s endpoints that fail to properly escape user input.

Generated by OpenCVE AI on April 29, 2026 at 19:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Ninja Tables plugin to version 5.2.4 or later.
  • If an update is not available, disable or uninstall the plugin until a fix is released.
  • Deploy a web‑application firewall rule to block suspicious SQL patterns against the Ninja Tables endpoints.

Generated by OpenCVE AI on April 29, 2026 at 19:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 11 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 10 Dec 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 09 Dec 2025 14:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.3.
Title WordPress Ninja Tables plugin <= 5.2.3 - SQL Injection vulnerability
Weaknesses CWE-89
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:19.622Z

Reserved: 2025-12-09T12:20:54.763Z

Link: CVE-2025-67519

cve-icon Vulnrichment

Updated: 2025-12-11T19:00:26.332Z

cve-icon NVD

Status : Deferred

Published: 2025-12-09T16:18:25.270

Modified: 2026-04-27T18:16:40.437

Link: CVE-2025-67519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T19:45:18Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')