CVE-2026-65049 describes an incorrect authorization vulnerability in the Ninja Forms WordPress plugin (version 3.14.8 and prior) used in multisite environments. The vulnerability arises from a site-scoped capability check that allows a subsite Administrator to invoke a network-wide destructive action via a crafted POST request to admin-ajax.php with the nf_delete_all_data action and a per-site nonce. The migration routines then iterate over all blogs in the multisite network using switch_to_blog(), dropping all nf3_* tables and clearing options and transients on every subsite. This occurs without requiring elevated super-admin or network-admin privileges, enabling a subsite Administrator to delete all Ninja Forms data network-wide.

An attacker with subsite Administrator privileges can cause complete deletion of all Ninja Forms data across every subsite in a WordPress multisite network. This results in loss of form data, configuration, and related options and transients for all sites in the network. The impact is high due to the broad scope of data destruction and the low privilege required to trigger it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subsite Administrator privileges to trusted users only and monitor for unusual POST requests to admin-ajax.php with the nf_delete_all_data action. Avoid enabling unsafe multisite migration defaults if possible. Follow official vendor guidance once published.