{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ninja-forms-plugin--3.14.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-65049"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ninja Forms plugin (\u003c= 3.14.8)","WordPress Multisite"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin","privilege-escalation","data-deletion","webserver","cve"],"_cs_type":"advisory","_cs_vendors":["Ninja Forms","WordPress"],"content_html":"\u003cp\u003eThe Ninja Forms plugin, specifically versions 3.14.8 and prior, for WordPress Multisite contains a critical authorization vulnerability, identified as CVE-2026-65049. This flaw allows a subsite Administrator, who typically has limited privileges, to trigger a network-wide deletion of all Ninja Forms data across the entire WordPress Multisite instance. Attackers exploit an incorrect site-scoped capability check in conjunction with unsafe multisite migration defaults. By sending a specially crafted POST request to the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint with the \u003ccode\u003enf_delete_all_data\u003c/code\u003e action and a valid per-site nonce, the attacker can invoke migration routines. These routines then unconditionally iterate through all blogs via \u003ccode\u003eswitch_to_blog()\u003c/code\u003e, dropping all \u003ccode\u003enf3_*\u003c/code\u003e tables and clearing associated options and transients on every subsite, without requiring super-admin or network-admin privileges. This vulnerability poses a severe data loss risk and can lead to significant operational disruption for organizations using WordPress Multisite with the affected Ninja Forms plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA subsite administrator, potentially a malicious insider or an external attacker who has gained subsite admin privileges, targets a vulnerable WordPress Multisite instance running Ninja Forms plugin version 3.14.8 or prior.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the Ninja Forms plugin's AJAX action \u003ccode\u003enf_delete_all_data\u003c/code\u003e as a potential vector for unauthorized operations.\u003c/li\u003e\n\u003cli\u003eA crafted HTTP POST request is prepared, targeting the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint on the WordPress Multisite instance.\u003c/li\u003e\n\u003cli\u003eThe request body includes the \u003ccode\u003eaction=nf_delete_all_data\u003c/code\u003e parameter and a valid per-site nonce to authenticate the request as originating from a legitimate subsite administrator.\u003c/li\u003e\n\u003cli\u003eThe WordPress application processes the request, and due to an incorrect authorization check, the \u003ccode\u003enf_delete_all_data\u003c/code\u003e action is allowed to proceed despite the subsite administrator lacking network-wide privileges.\u003c/li\u003e\n\u003cli\u003eThe Ninja Forms plugin's migration routines are invoked, which internally utilize \u003ccode\u003eswitch_to_blog()\u003c/code\u003e to programmatically iterate through every subsite configured within the WordPress Multisite network.\u003c/li\u003e\n\u003cli\u003eDuring this iteration, for each subsite, the plugin executes commands to drop all \u003ccode\u003enf3_*\u003c/code\u003e database tables and clears associated options and transients.\u003c/li\u003e\n\u003cli\u003eThe final objective is achieved: all Ninja Forms data is completely deleted across the entire WordPress Multisite network, resulting in a denial of service and data loss.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65049 results in the complete deletion of all Ninja Forms data across every subsite within a WordPress Multisite installation. This leads to a severe denial of service, as all forms and associated submissions become permanently inaccessible. Organizations relying on Ninja Forms for critical business processes, data collection, or customer interactions will face significant operational disruption, data loss, and potential regulatory compliance issues. The impact extends beyond a single subsite, affecting the entire network, making recovery complex and time-consuming. The CVSS v3.1 base score for this vulnerability is 9.3 (Critical).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Ninja Forms plugin to a version greater than 3.14.8 on all WordPress Multisite installations to patch CVE-2026-65049.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect attempts to exploit the \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint with the \u003ccode\u003enf_delete_all_data\u003c/code\u003e action.\u003c/li\u003e\n\u003cli\u003eEnsure web server logs (category \u003ccode\u003ewebserver\u003c/code\u003e) are configured to capture full HTTP request details, including \u003ccode\u003ecs-method\u003c/code\u003e, \u003ccode\u003ecs-uri-stem\u003c/code\u003e, and \u003ccode\u003ecs-uri-query\u003c/code\u003e, to enable detection.\u003c/li\u003e\n\u003cli\u003eReview access controls for all subsite administrators within WordPress Multisite environments, ensuring they operate with the principle of least privilege.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T15:20:33Z","date_published":"2026-07-21T15:20:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ninja-forms-rce/","summary":"A critical privilege escalation vulnerability, CVE-2026-65049, in the Ninja Forms plugin (version 3.14.8 and prior) for WordPress Multisite allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting an incorrect authorization check combined with unsafe multisite migration defaults, leading to severe data loss.","title":"Ninja Forms Plugin Vulnerability Allows Network-Wide Data Deletion in WordPress Multisite","url":"https://feed.craftedsignal.io/briefs/2026-07-ninja-forms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Ninja Forms Plugin (\u003c= 3.14.8)","version":"https://jsonfeed.org/version/1.1"}