Skip to content
Threat Feed
Subscribe

Product

WordPress Multisite

1 brief RSS
critical advisory

Ninja Forms Plugin Vulnerability Allows Network-Wide Data Deletion in WordPress Multisite

A critical privilege escalation vulnerability, CVE-2026-65049, in the Ninja Forms plugin (version 3.14.8 and prior) for WordPress Multisite allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting an incorrect authorization check combined with unsafe multisite migration defaults, leading to severe data loss.

Ninja Forms plugin +1 wordpress plugin privilege-escalation data-deletion webserver cve
1r 2t 1c