CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.
| CWE | CWE-862 |
| Vendor | saturday drive |
| Product | ninja forms - save progress |
| Published | Sep 5, 2026 |
| Last Updated | Sep 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for saturday drive ninja forms - save progress
Be the first to know when new medium vulnerabilities affecting saturday drive ninja forms - save progress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Saturday Drive / Ninja Forms - Save Progress
0 ≤ 3.0.30
References
Credits
Hermione