CyberRota Analysis
AI-GeneratedThe Ninja Forms plugin for WordPress Multisite, specifically versions 3.14.8 and earlier, is vulnerable to an authorization flaw that allows a subsite Administrator to delete all Ninja Forms data across the entire network. By exploiting this vulnerability, attackers can send a specially crafted POST request to the admin-ajax.php endpoint, enabling them to bypass necessary permissions and execute destructive migration routines. WordPress administrators using affected versions of the Ninja Forms plugin should prioritize immediate updates to mitigate the risk of widespread data loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.