Ninja Tables – Easy Data Table Builder <= 5.2.5 - Authenticated (Contributor+) Information Exposure

This research plan targets CVE-2026-25008, an information exposure vulnerability in Ninja Tables. The vulnerability exists because the plugin's custom REST API router (defined in app/Http/Routes/routes.php) uses a UserPolicy that likely only verifies a user is authenticated, failing to enforce high-level administrative capabilities (like manage_options) for sensitive data retrieval. This allows Contributor-level users to access table configurations and, more critically, the actual data rows stored within those tables.

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) Information Exposure.
• Location: Custom REST API endpoints registered in app/Http/Routes/routes.php and handled by TablesController and TableItemsController.
• Cause: Insufficient authorization checks within the UserPolicy or the controller methods. While the Admin UI is restricted via ninja_table_admin_role() in AdminMenuHandler.php, the underlying REST API allows any logged-in user to query table lists and row data.

2. Attack Vector Analysis

• Endpoint: /wp-json/ninja-tables/v1/tables and /wp-json/ninja-tables/v1/tables/{id}/item
• HTTP Method: GET
• Authentication: Authenticated (Contributor level or higher).
• Precondition: At least one table must exist in the system (created by an Administrator).
• Required Headers: X-WP-Nonce (standard WordPress REST API nonce).

3. Code Flow

1. Route Registration: In app/Http/Routes/routes.php, routes are grouped under $router->withPolicy('UserPolicy').
   • $route->get('/', [TablesController::class, 'index']) (Prefix: tables)
   • $route->get('/', [TableItemsController::class, 'index']) (Prefix: tables/{id}/item)
2. Request Handling: When a Contributor sends a request to /wp-json/ninja-tables/v1/tables, the UserPolicy is evaluated. If it only checks is_user_logged_in(), the request proceeds.
3. Data Retrieval:
   • TablesController::index() calls Post::getPosts(), which queries the ninja-table post type without ownership restrictions.
   • TableItemsController::index() (implied logic) queries the ninja_table_items database table for the given table ID and returns all rows.
4. Sink: The data is returned as a JSON response via $this->json($data, 200) in the controller.

4. Nonce Acquisition Strategy

The plugin uses the standard WordPress REST API nonce (wp_rest). Any authenticated user, including a Contributor, can retrieve this nonce from the default WordPress admin dashboard.

1. Login: Log in as the Contributor user using browser_login.
2. Navigate: Navigate to the WordPress Profile page (/wp-admin/profile.php).
3. Extract: Execute JavaScript to retrieve the nonce from the global wpApiSettings object provided by WordPress core.
   • Command: browser_eval("wpApiSettings.nonce")
4. Fallback: If wpApiSettings is not available, the nonce can be extracted from the page source where scripts are localized (searching for "nonce":"...").

5. Exploitation Strategy

Step 1: List All Tables

Retrieve the list of all tables to find the ID of a target table containing sensitive information.

• Endpoint: /wp-json/ninja-tables/v1/tables
• Method: GET
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Expected Response: A JSON object containing an array of tables in the data key.

Step 2: Extract Table Data

Retrieve the actual rows from the target table identified in Step 1.

• Endpoint: /wp-json/ninja-tables/v1/tables/{TABLE_ID}/item
• Method: GET
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Expected Response: A JSON object containing the values of every row in the table, potentially exposing PII or internal configurations.

Step 3: Leak User Information (Optional/Alternative)

Check if author information is exposed.

• Endpoint: /wp-json/ninja-tables/v1/wp-posts/authors
• Method: GET
• Headers: X-WP-Nonce: [EXTRACTED_NONCE]

6. Test Data Setup

1. Administrator Action:
   • Create a table named "Sensitive Customer Data".
   • Add columns: "Name", "Email", "Phone".
   • Insert a row: {"Name": "John Doe", "Email": "john@secret.com", "Phone": "555-0199"}.
2. Attacker Action:
   • Create a user with the Contributor role.

7. Expected Results

• The Contributor user, who should not have access to Ninja Tables data, successfully receives a 200 OK response from the REST endpoints.
• The JSON response contains the private table's title, settings, and row values (e.g., john@secret.com).

8. Verification Steps

1. Verify via WP-CLI: Check the database directly to confirm the table ID and content match the leaked data.
   • wp post list --post_type=ninja-table
   • wp db query "SELECT * FROM wp_ninja_table_items WHERE table_id = [ID]"
2. Check Permissions: Confirm the Contributor user lacks the manage_options capability.
   • wp user cap list [USER_ID]

9. Alternative Approaches

If the ninja-tables/v1 namespace is different in the specific version:

1. Check app/Hooks/Handlers/AdminMenuHandler.php inside getRestInfo():

   $ns  = $app->config->get('app.rest_namespace'); // Check config/app.php or equivalent
   $ver = $app->config->get('app.rest_version');
   

2. Search for register_rest_route calls in the entire codebase if the custom router is not used for all versions.
3. Test the shortcode-based info exposure in PublicDataHandler::tableInfoShortcode by creating a post as Contributor and inserting [ninja_table_info id="[ID]" field="last_editor"] to see if it bypasses the is_preview() check.