CVE-2026-15550

Name of the Vulnerable Software and Affected Versions Ninja Forms - Save Progress versions prior to 3.0.31

Description The plugin contains a missing authorization flaw resulting from a lack of capability checks and nonce verification (a unique token used to prevent cross-site request forgery) in the bulk actions() function. Authenticated users with subscriber-level access or higher can exploit this to delete arbitrary database records from the wp nf3 objects table, including saved submissions.

Recommendations Update the plugin to version 3.0.31 or later. As a temporary mitigation, restrict access to the bulk actions() function for users with subscriber-level permissions.