CVE-2026-65049 Saturday Drive CVE debrief

Who should care

WordPress Multisite users with Ninja Forms plugin installed should verify their version and update to a patched version if necessary. Site administrators and security teams should assess exposure and prioritize remediation.

Why it matters

CVE-2026-65049 is a high-severity vulnerability in the Ninja Forms plugin for WordPress Multisite, allowing subsite Administrators to delete all Ninja Forms data network-wide. Defenders should verify their plugin version, restrict access to admin-ajax.php, and monitor for suspicious requests.

• Subsite Administrators can delete all Ninja Forms data network-wide without super-admin or network-admin privileges
• Verification of Ninja Forms plugin version and update to patched version is required
• Monitoring for suspicious POST requests to admin-ajax.php is necessary

Technical summary

The Ninja Forms plugin for WordPress Multisite contains an incorrect authorization vulnerability in version 3.14.8 and prior. This allows a subsite Administrator to exploit a site-scoped capability check combined with unsafe multisite migration defaults, enabling network-wide deletion of all Ninja Forms data by sending a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce.

Defensive priority

High priority for WordPress Multisite users with Ninja Forms plugin installed; verify and update to patched version.

Recommended defensive actions

• Verify Ninja Forms plugin version and update to patched version if necessary
• Restrict access to admin-ajax.php endpoint
• Monitor for suspicious POST requests to admin-ajax.php
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE-2026-65049 details an incorrect authorization vulnerability in Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite. A subsite Administrator can exploit this by sending a crafted POST request to admin-ajax.php with nf_delete_all_data action, triggering network-wide deletion of all Ninja Forms data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.