Is CVE-2026-15550 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15550 being exploited in the wild.

How severe is CVE-2026-15550?

Medium severity, with a CVSS score of 4.3, published 5 September 2026.

Which products and versions are affected?

Ninja Forms Save Progress up to 3.0.30.

Is there a fix for CVE-2026-15550?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15550 attacked?

It is attacked over the network.

Am I affected by CVE-2026-15550?

Check whether you run Ninja Forms Save Progress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15550: Ninja Forms Save Progress missing authorization in bulk actions

CVE-2026-15550 · Severity: medium · CVSS 4.3 · Published 2026-09-05

The Ninja Forms Save Progress WordPress plugin allows users to save and resume form submissions across sessions. A flaw in the plugin fails to verify user permissions when processing bulk actions, permitting any authenticated user (even those with minimal subscriber-level access) to delete saved form submissions and other database records. This could result in loss of user data and disrupted form workflows.

Vendors: Ninja Forms.

Quick answers

Is CVE-2026-15550 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15550 being exploited in the wild.
How severe is CVE-2026-15550?: Medium severity, with a CVSS score of 4.3, published 5 September 2026.
Which products and versions are affected?: Ninja Forms Save Progress up to 3.0.30.
Is there a fix for CVE-2026-15550?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15550 attacked?: It is attacked over the network.
Am I affected by CVE-2026-15550?: Check whether you run Ninja Forms Save Progress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Ninja Forms Save Progress plugin (versions up to 3.0.30) contains a missing authorization vulnerability in the 'bulk_actions' function. The function lacks both capability checks (to verify if a user has permission to perform the action) and nonce verification (to prevent cross-site request forgery). An authenticated attacker with subscriber-level or higher privileges can craft requests to arbitrarily delete records from the 'wp_nf3_objects' database table, including saved form submissions. The vulnerability requires authentication but no additional user interaction or special privileges beyond basic site access. Patches addressing capability checks and nonce validation are expected from the vendor.

Affected products

Ninja Forms Save Progress up to 3.0.30

Timeline

2026-09-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.