CVE-2025-67519CWE-89sql-injection

CVE-2025-67519

High · published December 9, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

⚡ A crafty SQL injection vulnerability lurks in Ninja Tables, and it’s as sneaky as a thief slipping in through an open window! 🔍 Think of this vulnerability like an unmonitored delivery entrance where anyone can drop off or pick up packages at will, no questions asked. If left unchecked, attackers can easily manipulate the database, just like a mischievous delivery person swapping labels on important documents. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially allowing access to sensitive data, altering records, or even deleting entire tables! This could be absolutely devastating for your data integrity and security.

Put simply

Think of this vulnerability like an unmonitored delivery entrance where anyone can drop off or pick up packages at will, no questions asked. If left unchecked, attackers can easily manipulate the database, just like a mischievous delivery person swapping labels on important documents. This SQL injection flaw in Ninja Tables lets attackers manipulate queries by injecting malicious code, bypassing intended protections and leading to unauthorized database interactions. It affects versions from n/a through 5.2.3.

What to do

An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially allowing access to sensitive data, altering records, or even deleting entire tables! This could be absolutely devastating for your data integrity and security. Update Ninja Tables to the latest version immediately to patch this vulnerability. Additionally, review your database queries and ensure you’re using prepared statements to minimize the risk of SQL injection in the future. This is fixable! Follow these steps and you'll have your tables secured in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-09T21:18Z
References (1)
EPSS history
Timeline
  • 09 DEC 14:13Z
    WordPress Ninja Tables plugin <= 5.2.3 - SQL Injection vulnerability
    cvelistv5