Executive brief
The Ninja Forms Save Progress WordPress plugin allows users to save and resume form submissions across sessions. A flaw in the plugin fails to verify user permissions when processing bulk actions, permitting any authenticated user (even those with minimal subscriber-level access) to delete saved form submissions and other database records. This could result in loss of user data and disrupted form workflows.
Technical details
The Ninja Forms Save Progress plugin (versions up to 3.0.30) contains a missing authorization vulnerability in the 'bulk_actions' function. The function lacks both capability checks (to verify if a user has permission to perform the action) and nonce verification (to prevent cross-site request forgery). An authenticated attacker with subscriber-level or higher privileges can craft requests to arbitrarily delete records from the 'wp_nf3_objects' database table, including saved form submissions. The vulnerability requires authentication but no additional user interaction or special privileges beyond basic site access. Patches addressing capability checks and nonce validation are expected from the vendor.
Affected products
- Ninja Forms Save Progress up to 3.0.30
Timeline
- 2026-09-05: disclosed