CVE-2026-15550CWE-862broken-access-control

CVE-2026-15550

Medium · published September 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.4
In the wild
Unconfirmed
What it is

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-05T16:16Z
References (2)
https://ninjaforms.com/extensions/save-progress/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d3e6ce-e6d7-455b-a43d-a14189b30491?source=cve · [email protected]
EPSS history
Timeline
  • 07 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 05 SEP 11:28Z
    Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
    cvelistv5