Executive brief
Ninja Forms is a popular WordPress plugin used to create and manage website forms. A security flaw in versions 3.14.8 and earlier allows an administrator of a single subsite on a WordPress Multisite network to delete all form data across the entire network. This could lead to a total loss of customer submissions, form configurations, and related data for every site in the organization.
Technical details
Ninja Forms version 3.14.8 and prior contains an incorrect authorization vulnerability (CWE-863) within its AJAX handling. The plugin uses a site-scoped capability check for the 'nf_delete_all_data' action instead of a network-wide check. An attacker with subsite administrator privileges can send a crafted POST request to 'admin-ajax.php' using a per-site nonce. This triggers migration routines that use 'switch_to_blog()' to iterate through all sites in the network, dropping 'nf3_*' database tables and clearing options/transients globally. The vulnerability is fixed in version 3.14.9.
Affected products
- Saturday Drive Ninja Forms <= 3.14.8
Timeline
- 2026-07-21: advisory: NVD and VulnCheck published the advisory.
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 3.14.9