CVE-2026-65049 is an incorrect authorization vulnerability in the Ninja Forms WordPress plugin (<=3.14.8) affecting multisite installations. The vulnerability arises from a site-scoped capability check combined with unsafe multisite migration defaults, allowing a subsite Administrator to invoke a crafted POST request to admin-ajax.php with the nf_delete_all_data action and a per-site nonce. This triggers migration routines that iterate over all blogs in the network using switch_to_blog(), unconditionally dropping all nf3_* tables and clearing options and transients across every subsite. This action does not require super-admin or network-admin privileges, enabling a subsite Administrator to cause network-wide data deletion.

An attacker with subsite Administrator privileges can delete all Ninja Forms data across the entire WordPress multisite network. This includes dropping all nf3_* tables and clearing options and transients on every subsite, resulting in significant data loss and disruption of form functionality network-wide. The vulnerability does not require elevated network-wide privileges, increasing the risk of exploitation within multisite environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subsite Administrator privileges where possible and monitor for suspicious POST requests to admin-ajax.php with the nf_delete_all_data action. Avoid using unsafe multisite migration defaults if configurable. Follow updates from Saturday Drive for an official patch or mitigation instructions.