CVE-2026-15550: CWE-862 Missing Authorization in Saturday Drive Ninja Forms - Save Progress

CVE-2026-15550 is a missing authorization vulnerability (CWE-862) in the Ninja Forms - Save Progress WordPress plugin, versions up to and including 3.0.30. The vulnerability arises from the absence of capability checks and nonce verification in the 'bulk_actions' function. This security gap enables authenticated attackers with subscriber-level privileges or higher to delete arbitrary database records from the 'wp_nf3_objects' table, potentially resulting in loss of saved form submissions. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity due to unauthorized deletion of data. There is no vendor advisory or patch information currently available to confirm remediation status.

An attacker with subscriber-level or higher access can delete arbitrary records from the plugin's database table, leading to potential loss of saved form submission data. There is no direct confidentiality or availability impact reported. The integrity of stored form data is compromised due to unauthorized deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to form data deletion. Avoid granting subscriber-level or higher access to untrusted users.