Description

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T12:16:47.050Z",
  "pubdate": "2026-09-05T12:16:47.050Z",
  "executiveSummary": "The Ninja Forms - Save Progress plugin for WordPress contains a critical Missing Authorization vulnerability, identified in versions up to and including 3.0.30.\nThe flaw resides within the 'bulk_actions' function, which fails to implement necessary capability checks or cryptographic nonce verification during execution.\nThis vulnerability allows authenticated users with subscriber-level permissions or higher to perform unauthorized administrative actions.\nSpecifically, an attacker can manipulate the plugin to trigger the deletion of arbitrary records within the 'wp_nf3_objects' database table.\nThis impact results in the loss of saved form submissions and potential data integrity compromise within the WordPress database.\nExploitation requires the attacker to possess at least a subscriber-level account on the target WordPress installation.\nGiven the nature of the flaw, the risk implication is significant as it facilitates unauthorized database modification by low-privileged users, potentially leading to service disruption or loss of critical user-submitted information.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the 'bulk_actions' function within the Ninja Forms - Save Progress plugin. The function processes administrative requests without performing adequate authorization checks or verifying the integrity of the request via a security nonce.\nIn the WordPress environment, nonces are critical for preventing Cross-Site Request Forgery (CSRF) and ensuring that requests are intentional and originate from authorized contexts. The absence of these checks means the 'bulk_actions' function does not validate whether the current user has the 'manage_options' capability or any other administrative privilege required to modify form-related data.\nThe attack flow proceeds as follows: An attacker authenticated as a subscriber sends a crafted request targeting the 'bulk_actions' endpoint. Because the function lacks the necessary server-side validation, it treats the request as legitimate. The function subsequently executes database operations on the 'wp_nf3_objects' table. An attacker can manipulate the request parameters to target specific IDs within the 'wp_nf3_objects' table, effectively deleting saved progress or form submission data.\nThe scope of this vulnerability extends to any database record stored within the 'wp_nf3_objects' table, as the lack of input validation and authorization checks allows for unconstrained row deletion. This constitutes an Insecure Direct Object Reference (IDOR) pattern facilitated by the missing authorization checks.\nFrom a post-exploitation perspective, the primary impact is the unauthorized deletion of site data. This does not lead to remote code execution (RCE) directly, but it significantly undermines the integrity of the plugin's data store. Attackers could systematically delete entries, leading to data loss and potential service denial regarding the 'Save Progress' functionality of the forms. Since the plugin operates on the server-side, the exploitation is performed via standard HTTP POST requests directed at the WordPress backend, which are fully accessible to any authenticated subscriber user."
}