CVE-2026-15550: Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wpnf3objects' table, such as saved submissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ninja Forms - Save Progressto a version that resolves this vulnerability.Fixed in 3.0.30 - Compensating control
Restrict access to WordPress admin-ajax.php endpoints so only trusted users/roles can invoke the affected 'bulk_actions' functionality that lacks capability checks and nonce verification.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or a higher role can exploit it. The attacker does not need administrative privileges.
What data can be deleted?
An attacker can delete arbitrary records from the wp_nf3_objects database table, including saved form submissions. The available information describes an integrity impact only; it does not indicate data disclosure or service disruption.
Are sites running the affected plugin versions exposed by default?
The issue is in the plugin's bulk_actions function because it lacks capability checks and nonce verification. Therefore, an affected installation is exposed when an attacker can authenticate to the WordPress site with at least a Subscriber account.
How can exposure be reduced if an update is not immediately available?
Limit or remove Subscriber and other low-privilege accounts that are not required, and prevent untrusted users from registering or authenticating. Review the wp_nf3_objects table and saved-submission records for unexpected deletions.