Authorization Flaw in Ninja Forms Plugin for WordPress Multisite

CVE-2026-65049

What is CVE-2026-65049?

The Ninja Forms plugin for WordPress Multisite prior to version 3.14.9 is exposed to an authorization vulnerability, where a subsite Administrator can exploit this weakness to perform a network-wide deletion of all Ninja Forms data. This is achieved by sending a specially crafted POST request to the admin-ajax.php endpoint, utilizing the nf_delete_all_data action and a per-site nonce. The flaw arises from improper capability checks during multisite migrations, enabling attackers to relinquish all nf3_* tables and clear options and transients across all subsites within the network without needing super-admin or network-admin permissions.

References