CVE-2026-65049 Details

An incorrect authorization vulnerability has been identified in the Ninja Forms plugin for WordPress Multisite, affecting versions through 3.14.8. This vulnerability allows a subsite Administrator to initiate a network-wide deletion of all Ninja Forms data. The issue arises from a site-scoped capability check that is exploited to bypass authorization, combined with unsafe defaults during multisite migrations. By sending a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce, an attacker can invoke migration routines that unconditionally iterate through all blogs. This process drops all nf3_* tables and clears options and transients across every subsite in the network, all without the need for super-admin or network-admin privileges.

Users are advised to update the Ninja Forms plugin to version 3.14.9 or later, where this vulnerability has been fixed.