CVE-2026-65049
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
- Score
- CVSS 3.1 9.3 Critical
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-07-21
- Last modified
- 2026-10-24
- Weaknesses
- CWE-863
Affected products
References
- https://wordpress.org/plugins/ninja-forms/
- https://wordpress.org/plugins/ninja-forms/changelog/
- https://www.vulncheck.com/advisories/ninja-forms-cross-site-network-wide-data-deletion-on-wordpress-multisite-via-nf-de…
