Ninja Forms CVE-2026-65049

Exploitation requires a WordPress Multisite deployment of Ninja Forms 3.14.8 or earlier and a request to the admin-ajax.php endpoint using the specific nf_delete_all_data action accompanied by a valid per-site nonce. The concrete prerequisites are: the target must run Ninja Forms in Multisite mode (single-site installs do not experience the network-wide iteration), and the actor must be a subsite Administrator holding a valid per-site nonce - or must coerce such an admin into submitting the request cross-site (UI:A in the vendor vector indicates victim interaction is involved). Limiting factors that reduce real-world risk: the network-wide behavior only manifests on Multisite (not standard single-site WordPress), a valid per-site nonce is needed, and the actor/victim must already hold subsite Administrator privileges; the vendor vector's PR:N versus the description's 'subsite Administrator' framing should be reconciled against the VulnCheck advisory before treating it as fully unauthenticated.

The vendor CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H) reflects high integrity and availability impact both to the vulnerable subsite and to subsequent systems (other subsites), with no confidentiality impact - consistent with pure data destruction rather than data theft. Note a signal conflict worth flagging: the vendor vector uses PR:N (unauthenticated) with UI:A (active user interaction), and the VulnCheck advisory title describes a 'cross-site' technique, implying a CSRF-style delivery where a victim subsite Administrator is tricked into submitting the request; yet the description itself frames the actor as a 'subsite Administrator' who already holds admin rights and a valid per-site nonce. Treat the realistic actor as a subsite admin (legitimately lower-privileged than network admin) or an attacker who coerces one via CSRF - verify the exact preconditions with the vendor/VulnCheck advisory. There is no EPSS score, no KEV listing, and no known POC in the provided data, so this is not evidence of active mass exploitation; however, the low attack complexity, network vector, and catastrophic destructive impact on multi-tenant Multisite hosts make it a genuine priority for any environment running Ninja Forms in a Multisite configuration.

An attacker who controls (or can trick) a subsite Administrator on a WordPress Multisite network crafts a POST to /wp-admin/admin-ajax.php carrying action=nf_delete_all_data and a valid per-site nonce - for example by luring the admin to a malicious page that auto-submits the request while they are logged in. The migration routine then walks every blog in the network via switch_to_blog(), dropping all nf3_* tables and clearing Ninja Forms options and transients network-wide. No public POC is identified in the available data, but the low complexity and single crafted request make this straightforward to reproduce once the nonce is obtained.