CVE-2026-65049
Deferred Deferred - Pending Action

Incorrect Authorization in Ninja Forms WordPress Plugin Allows Network-Wide Data Deletion

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-65049
EUVD
EUVD-2026-46269

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
ninja_forms ninja_forms to 3.14.8 (exc)
wpninjas ninja_forms to 3.14.9 (exc)
ninja_forms ninja_forms to 3.14.9 (exc)
ninja_forms ninja_forms From 3.14.9 (inc)
ninja_forms ninja_forms From 3.14.10 (inc)
ninja_forms ninja_forms to 3.14.7 (exc)
ninja_forms ninja_forms to 3.14.6 (exc)
ninja_forms ninja_forms to 3.14.5 (exc)
wpninjas ninja_forms From 3.14.9 (inc)
wpninjas ninja_forms From 3.14.10 (inc)
wpninjas ninja_forms to 3.14.5 (exc)
wpninjas ninja_forms to 3.14.6 (exc)
wpninjas ninja_forms to 3.14.7 (exc)
wpninjas ninja_forms to 3.14.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Ninja Forms plugin on WordPress Multisite installations. It allows a subsite Administrator to delete all Ninja Forms data across the entire network by exploiting an incorrect authorization check. The flaw enables sending a crafted POST request to trigger network-wide data deletion without needing super-admin privileges.

Detection Guidance

Check if Ninja Forms plugin version is 3.14.8 or prior. Look for suspicious POST requests to admin-ajax.php with the nf_delete_all_data action. Monitor for deletion of nf3_* tables across all subsites in a WordPress Multisite environment.

Impact Analysis

An attacker with subsite Administrator access could delete all Ninja Forms data across every site in the WordPress Multisite network. This includes dropping database tables and clearing settings, leading to loss of form data, submissions, and plugin configurations network-wide.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by causing unauthorized deletion of sensitive form data across the network. Loss of data may violate retention and integrity requirements.

Mitigation Strategies

Update Ninja Forms plugin to version 3.14.9 or later immediately. Remove unnecessary admin privileges for subsite users. Review server logs for signs of exploitation attempts targeting admin-ajax.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart