PT-2026-61952 · Saturday Drive · Ninja Forms

Pavel Kohout · CVE-2026-65049 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf delete all data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch to blog(), dropping all nf3 * tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-65049

Affected Products

Ninja Forms

References · 4

• https://wordpress.org/plugins/ninja-forms/changelog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65049 · Security Note
• https://vulncheck.com/advisories/ninja-forms-cross-site-network-wide-data-deletion-on-wordpress-multisite-via-nf-delete-all-data-ajax-action · Note
• https://wordpress.org/plugins/ninja-forms · Note