Ninja Forms Save Progress EUVD-2026-71992

The attacker must hold a valid WordPress account with at least subscriber-level privileges on the target site - the lowest authenticated role in WordPress, available to any registered user. The Ninja Forms - Save Progress plugin must be installed, active, and running version ≤3.0.30. Exploitation is strictly limited to deleting records from the wp_nf3_objects table (saved form submissions); no data exfiltration, code execution, privilege escalation to administrator, or impact on other tables is achievable through this flaw alone. Sites that have disabled open user registration, require manual account approval, or restrict registration to known users are significantly less exposed, as the attacker must first obtain valid credentials by other means.

The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures the bounded scope: network-accessible and low-complexity, but gated behind subscriber-level authentication, with integrity-only impact and no confidentiality or availability consequence. No EPSS data is present in available intelligence, no CISA KEV entry exists, and no proof-of-concept has been identified, meaning the practical exploitation risk is low. The primary threat model is a malicious or disgruntled registered user on a WordPress site that permits open registration - common on membership portals, e-commerce platforms, and citizen-services sites; even a mid-sized municipal IT team in zabrze running a resident-facing forms portal would find this manageable given the authentication barrier, though operational impact from form data loss should not be dismissed. The 'Authentication Bypass' tag applied to this CVE is inaccurate and overstates the vulnerability class; this is a missing authorization flaw within an already-authenticated session, not a bypass of authentication itself.

An attacker registers or otherwise obtains a subscriber-level account on a WordPress site running Ninja Forms - Save Progress ≤3.0.30, then sends a crafted POST request to the WordPress AJAX endpoint invoking the bulk_actions handler with targeted record IDs from the wp_nf3_objects table. Because no capability check or nonce validation is enforced, all specified saved form submissions are permanently deleted without any further privilege escalation. No public proof-of-concept has been confirmed at the time of analysis.