# CVE-2026-65049: Saturday Drive Ninja Forms incorrect authorization in WordPress Multisite

Source: https://junglewise.ai/threats/cve-2026-65049-saturday-drive-ninja-forms-incorrect-authorization-in-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-65049 · Severity: critical · CVSS 9.3 · Published 2026-07-21

Ninja Forms is a popular WordPress plugin used to create and manage website forms. A security flaw in versions 3.14.8 and earlier allows an administrator of a single subsite on a WordPress Multisite network to delete all form data across the entire network. This could lead to a total loss of customer submissions, form configurations, and related data for every site in the organization.

Technologies: [Saturday Drive Ninja Forms](https://junglewise.ai/threats/technologies/ninja-forms). Vendors: [Saturday Drive](https://junglewise.ai/threats/vendors/saturday-drive).

## Quick answers

**Is CVE-2026-65049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65049 being exploited in the wild.

**How severe is CVE-2026-65049?** Critical severity, with a CVSS score of 9.3, published 21 July 2026.

**Which products and versions are affected?** Saturday Drive Ninja Forms <= 3.14.8.

**Is there a fix for CVE-2026-65049?** A patch was published on 2026-07-21: Fixed in version 3.14.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65049 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65049?** Check whether you run Saturday Drive Ninja Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Ninja Forms version 3.14.8 and prior contains an incorrect authorization vulnerability (CWE-863) within its AJAX handling. The plugin uses a site-scoped capability check for the 'nf_delete_all_data' action instead of a network-wide check. An attacker with subsite administrator privileges can send a crafted POST request to 'admin-ajax.php' using a per-site nonce. This triggers migration routines that use 'switch_to_blog()' to iterate through all sites in the network, dropping 'nf3_*' database tables and clearing options/transients globally. The vulnerability is fixed in version 3.14.9.

## Affected products

- Saturday Drive Ninja Forms <= 3.14.8

## Timeline

- 2026-07-21: advisory: NVD and VulnCheck published the advisory.
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 3.14.9

## References

- [https://wordpress.org/plugins/ninja-forms/](https://wordpress.org/plugins/ninja-forms/)
- [https://wordpress.org/plugins/ninja-forms/changelog/](https://wordpress.org/plugins/ninja-forms/changelog/)
- [https://www.vulncheck.com/advisories/ninja-forms-cross-site-network-wide-data-deletion-on-wordpress-multisite-via-nf-delete-all-data-ajax-action](https://www.vulncheck.com/advisories/ninja-forms-cross-site-network-wide-data-deletion-on-wordpress-multisite-via-nf-delete-all-data-ajax-action)

## Related threats

- [Ninja Forms SQL injection in form import settings](https://junglewise.ai/threats/cve-2026-15663-ninja-forms-sql-injection-in-form-import-settings)
- [Saturday Drive Ninja Forms improper input validation in form calculations](https://junglewise.ai/threats/cve-2026-65052-saturday-drive-ninja-forms-improper-input-validation-in-form)
- [Saturday Drive Ninja Forms validation bypass in AJAX submission handler](https://junglewise.ai/threats/cve-2026-65051-saturday-drive-ninja-forms-validation-bypass-in-ajax-submission)
- [Saturday Drive Ninja Forms missing authorization in submissions-table block](https://junglewise.ai/threats/cve-2026-65050-saturday-drive-ninja-forms-missing-authorization-in-submissions)
- [Saturday Drive Ninja Forms stored XSS in Repeatable Fieldset](https://junglewise.ai/threats/cve-2026-65048-saturday-drive-ninja-forms-stored-xss-in-repeatable-fieldset)