Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-65049— Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action

CVSS 9.3 · Critical EPSS 0.27% · P20

Affected Version Matrix 2

VendorProductVersion RangeStatus
Saturday DriveNinja Forms< 3.14.9affected
3.14.9unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-65049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Ninja Forms 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Ninja Forms是WordPress基金会的一款信息化产品。 WordPress Ninja Forms 3.14.8及之前版本存在授权问题漏洞，该漏洞源于错误的授权检查，结合不安全的Multisite迁移默认设置，允许子站点管理员通过利用站点范围的权限检查缺陷，发送特制POST请求到admin-ajax.php端点，触发迁移程序无条件遍历所有博客，删除整个网络中所有Ninja Forms数据表、选项和临时数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Saturday DriveNinja Forms 0 ~ 3.14.9 -

II. Public POCs for CVE-2026-65049

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65049

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-65049 (1)

Vendor Pages for CVE-2026-65049 (1)

Same Patch Batch · Saturday Drive · 2026-07-21 · 5 CVEs total

CVE-2026-650489.3 CRITICALNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission
CVE-2026-650527.5 HIGHNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSe
CVE-2026-650516.5 MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJ
CVE-2026-650506.5 MEDIUMNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Subm

IV. Related Vulnerabilities

Same product: Ninja Forms
Same vendor: Saturday Drive
Same weakness: CWE-863

V. Comments for CVE-2026-65049

No comments yet

Leave a comment