CVE-2026-65049

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.14.9

Description An incorrect authorization issue exists in WordPress Multisite environments. A subsite Administrator can trigger the network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check and unsafe multisite migration defaults. This is achieved by sending a crafted POST request to the 'admin-ajax.php' endpoint using the nf delete all data action and a per-site nonce. This process invokes migration routines that use the switch to blog() function to iterate through all blogs, dropping all nf3 * tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

Recommendations Update Ninja Forms plugin to version 3.14.9 or later.