Which versions of Ninja Forms are affected by CVE-2026-65049?

A vulnerability in Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows subsite administrators to delete all form submissions and data across an entire WordPress Multisite network.. A patch is available.

How to fix or mitigate CVE-2026-65049?

Within 24 hours: Update Ninja Forms to the patched version per vendor advisory from the official WordPress plugin repository; if patching is not immediately possible, disable the Ninja Forms plugin to prevent exploitation. Within 7 days: Verify the patch has been deployed across all subsites and restore normal plugin operations; test form functionality to ensure proper operation. Within 30 days: Audit WordPress administrative logs for evidence of suspicious data deletion activities, review and restrict subsite administrator permissions to only users who require them, and conduct a backup recovery drill to verify form submissions can be restored if needed.

Ninja Forms CVE-2026-65049

Q: What is the CVSS score of CVE-2026-65049?

CVE-2026-65049 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46269 HIGH

Incorrect Authorization (CWE-863)

2026-07-21 VulnCheck

GHSA-8235-3h67-fv4q

PHP WordPress Authentication Bypass Ninja Forms Wordpress Plugin Saturday Drive

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Realistic actor is an authenticated subsite Administrator (PR:L); the site-scoped check but network-wide effect crosses authorization boundaries into other subsites (S:C); pure data destruction gives I:H/A:H and C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:02 vuln.today

CVE Published

Jul 21, 2026 - 14:22 cve.org

HIGH 8.4

DescriptionCVE.org

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

Articles & Coverage 2

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026 News 5 New PHP Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Ninja Forms (vendor: Saturday Drive; CPE cpe:2.3:a:saturday_drive:ninja_forms:*), a widely used PHP form-builder plugin, running under WordPress Multisite. The root cause is CWE-863 (Incorrect Authorization): the AJAX handler validates a WordPress capability that is scoped only to the current subsite, but the underlying migration/upgrade routine it invokes is network-global. That routine loops over all blogs with WordPress's switch_to_blog() API and unconditionally executes destructive schema operations (DROP of nf3_* tables) and option/transient clearing on each. Because the capability model in Multisite distinguishes a subsite Administrator from a network Super Admin, the mismatch between a site-scoped permission gate and a network-wide side effect is what elevates a routine data-reset feature into a network-wide destructive primitive.

RemediationAI

Patch available per vendor advisory - upgrade Ninja Forms to the fixed release above 3.14.8 as published in the plugin changelog (https://wordpress.org/plugins/ninja-forms/changelog/); the exact patched version number is not stated in the provided data, so confirm it against the changelog before deploying. Until patched, apply compensating controls tailored to Multisite: block or restrict the admin-ajax.php nf_delete_all_data action at the WAF/reverse-proxy layer (trade-off: legitimate data-reset from the admin UI will fail); tighten who holds the subsite Administrator role and, where possible, limit destructive plugin management to Super Admins only (trade-off: subsite operators lose self-service plugin control); and ensure fresh, tested database backups of the nf3_* tables and network options exist so a triggered deletion is recoverable (trade-off: does not prevent the deletion, only limits its damage). Because a cross-site delivery is plausible, also enforce standard CSRF hardening and educate subsite admins against following unexpected admin links. Review the VulnCheck advisory for any additional vendor-recommended mitigations.