CVE-2026-65049: Critical Vulnerability in Ninja Forms Plugin for WordPress Multisite

Executive Summary

A critical vulnerability (CVE-2026-65049) with a CVSS score of 9.3 has been identified in the Ninja Forms plugin (version 3.14.8 and prior) for WordPress Multisite. This vulnerability allows a subsite Administrator to delete all Ninja Forms data network-wide, without needing super-admin or network-admin privileges. The vulnerability is exploitable via a crafted POST request to the admin-ajax.php endpoint.

Technical Analysis

The vulnerability class is an incorrect authorization issue. The attack vector involves sending a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce. This triggers migration routines that iterate over all blogs via switch_to_blog(), resulting in the deletion of all nf3_* tables, options, and transients across every subsite in the network. The root cause is a site-scoped capability check combined with unsafe multisite migration defaults.

How It Gets Exploited

An attacker with Administrator privileges on a subsite of a WordPress Multisite network can exploit this vulnerability. They would send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a valid per-site nonce. Upon triggering the vulnerability, the attacker can invoke migration routines that unconditionally iterate over all blogs, effectively dropping all nf3_* tables and clearing options and transients across the entire network. This results in the network-wide deletion of all Ninja Forms data without requiring super-admin or network-admin privileges.

Impact Assessment

The Ninja Forms plugin versions 3.14.8 and prior for WordPress Multisite are affected. An attacker can achieve network-wide deletion of all Ninja Forms data, leading to high integrity and availability impacts. The CVSS score of 9.3 indicates critical severity.

Recommended Actions

To mitigate this vulnerability, update the Ninja Forms plugin to version 3.14.9 or later. Additionally, network administrators should monitor their WordPress Multisite installations for any suspicious activity related to the admin-ajax.php endpoint and nf_delete_all_data action. Implement Web Application Firewall (WAF) rules to detect and block suspicious POST requests to admin-ajax.php.

Sources

- National Vulnerability Database (NVD) - Vulncheck