CVE-2026-15550: Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook

Published Sep 5, 2026
·
Updated

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wpnf3objects' table, such as saved submissions.

Affected Software

1 affected component
WordPress Ninja Forms - Save Progress<=3.0.30

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Ninja Forms - Save Progress to a version that resolves this vulnerability.

    Fixed in 3.0.30
  2. Compensating control

    Restrict access to WordPress admin-ajax.php endpoints so only trusted users/roles can invoke the affected 'bulk_actions' functionality that lacks capability checks and nonce verification.

Event History

Sep 5, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or a higher role can exploit it. The attacker does not need administrative privileges.

2

What data can be deleted?

An attacker can delete arbitrary records from the wp_nf3_objects database table, including saved form submissions. The available information describes an integrity impact only; it does not indicate data disclosure or service disruption.

3

Are sites running the affected plugin versions exposed by default?

The issue is in the plugin's bulk_actions function because it lacks capability checks and nonce verification. Therefore, an affected installation is exposed when an attacker can authenticate to the WordPress site with at least a Subscriber account.

4

How can exposure be reduced if an update is not immediately available?

Limit or remove Subscriber and other low-privilege accounts that are not required, and prevent untrusted users from registering or authenticating. Review the wp_nf3_objects table and saved-submission records for unexpected deletions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203