search

Ninja Tables <4.1.9 - Unauthenticated Arbitrary File Read [LFI]

This comprehensive security research details a critical vulnerability discovered in the Ninja Tables WordPress plugin that allows unauthenticated attackers to read arbitrary files from the target server.

hashtag
Vulnerability Details: Unauthenticated Arbitrary File Read via `ninja_table_force_download`

CVE: Pending Assignment

CVSS Score: 7.5 (High)

Affected Versions: Ninja Tables < 4.1.9

Vulnerability Type: Local File Inclusion (LFI)

The Ninja Tables plugin for WordPress contains a critical vulnerability in the AJAX action `ninja_table_force_download`. The vulnerability stems from insufficient input validation of the `url` parameter, which allows unauthenticated attackers to traverse the file system and read arbitrary files from the server.

Attackers can exploit this vulnerability to access sensitive files including system configuration files (`/etc/passwd`, `/etc/os-release`), application configuration files (`wp-config.php`), environment variables (`.env`), and application logs.

hashtag
Proof of Concept (PoC) Steps

hashtag
1. Extract the Nonce

First, we need to extract the public nonce from the target website's source code:


curl -s https://target.com | grep -oP '"ninja_table_public_nonce":"\K[a-z0-9]+'

Expected output:

hashtag
2. Read `/etc/os-release`

HTTP Request

Server Response

hashtag
3. Read `/etc/passwd`

HTTP Request

Server Response

hashtag
Security Impact

  • Unauthenticated Local File Read

  • Disclosure of sensitive server files (/etc/passwd, /wp-config.php, .env, logs)

  • May lead to database credential leakage, full site compromise, or privilege escalation

hashtag
Remediation

Update the Ninja Tables plugin to version 4.1.9 or higher where this issue has been patched.

hashtag
References

PreviousCVE-2025-29927 Nginx + Next.js Middleware BypassNextCreate a Python POC Script

Last updated