Ninja Forms Save Progress
Monthly
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.