Admin-takeover flaws in WordPress Ninja Forms: CVE-2026-65048 and CVE-2026-65049 — update to 3.14.9

Ninja Forms, a WordPress form-builder plugin used on more than 600,000 sites, has two serious flaws. CVE-2026-65048 can let someone who isn't logged in take over an administrator simply by submitting a contact form that plants a malicious script in the admin dashboard. The other, CVE-2026-65049, lets a low-privilege user wipe form data across the site in one shot. Both are rated 9.3 (Critical).

The vendor, Saturday Drive, has shipped the fix in Ninja Forms 3.14.9, and the current latest release is 3.14.10. WordPress plugins often don't auto-update by default, so plenty of sites sit on old versions. Ninja Forms has been abused in real attacks before, so a prompt update matters this time too. Below we walk through what happens and how to check whether your site is affected.

Who targets this, and why

The people who exploit the more dangerous CVE-2026-65048 are attackers who sweep the web for sites running an old Ninja Forms and send crafted strings through their contact forms. No login is needed — any public "contact," "signup," or "request" form is enough for an outsider to try. This isn't just about high-profile sites; small business and personal sites with a form are equally in scope.

The malicious script the attacker submits runs with the administrator's own privileges the moment that admin opens the submission in the dashboard. From there it can be used to impersonate the admin and silently create a new administrator account, plant malicious code on the site, or rewrite posts and settings. The nasty part is that the attacker only has to wait: the site owner's everyday act of reviewing incoming messages is the trigger.

The damage doesn't stop at owners. A hijacked site becomes a base for redirecting visitors to fake pages or planting code that steals the personal data they enter. With CVE-2026-65049, the entire archive of submissions and requests can be erased, directly wiping out business records. WordPress core also has a site-takeover flaw from the same period, so updates are urgent on both the core and plugin fronts.

The two flaws in detail

CVE-2026-65048 (CVSS 9.3): a script planted in a form runs in the admin dashboard

This flaw is in Ninja Forms' "Repeatable Fieldset" feature, which lets the same fields be entered multiple times. The internal routine that handles the order of each submitted field (parseSubmissionIndex()) accepted arbitrary strings without checking they were numbers, and that value was interpolated straight into the admin-side HTML (admin_form_element()). This is a "stored cross-site scripting (XSS)" flaw — an attack where a malicious script the attacker submits is saved on the server and later runs in the browser of whoever views that content.

Here, an outside attacker can save the malicious script just by submitting a form, and it runs with the owner's privileges the instant the owner opens that submission in the admin dashboard. Because no login is required and the owner's ordinary "check my messages" action is the trigger, it is rated a high 9.3. When it runs, it can be used to hijack the admin's session, create a new administrator account, or install malicious code on the site.

CVE-2026-65049 (CVSS 9.3): a low-privilege admin can wipe every site's data

This one matters in "multisite" setups, where several sites are run from one WordPress. Network-wide operations should be reserved for the top-level (super) admin, but Ninja Forms' permission check only looked at per-site privileges. As a result, a user who is merely a subsite administrator can, by sending a crafted request, bulk-delete all Ninja Forms data across the network. Form definitions and the accumulated records of submissions and requests can all be lost, which is why this too is rated 9.3. It is a textbook "broken authorization" case where someone without super-admin rights can cross that boundary and run a destructive operation.

Is my site affected? (Quick reference)

Whether you're affected comes down to the Ninja Forms version you're running. You can find it in the WordPress admin under "Plugins." Match it against the table below.

CVE-2026-65048 in particular is riskier the more publicly your forms are exposed. If you built "contact," "brochure request," or "booking" forms in Ninja Forms that need no login, anyone outside can submit them, so update as a priority. Operators running Ninja Forms on multisite should also keep the bulk-deletion risk of CVE-2026-65049 in mind.

What to do right now

The fix is simple: update Ninja Forms to 3.14.9 or later (ideally the latest, 3.14.10). Open "Plugins" in the WordPress admin, and if there's an update notice for Ninja Forms, click "Update." Afterward, confirm the version reads 3.14.9 or later. Taking a backup before updating is a sensible precaution.

If you can't update immediately, you can blunt CVE-2026-65048 as a stopgap by not casually opening incoming submissions in the admin, or by temporarily pausing public forms. These are only bandages, though — the real fix is the update. Turning on automatic plugin updates also helps you keep up with future flaws without gaps.

As of publication, there is no report of these two flaws being used in real attacks and no listing on the U.S. CISA catalog of actively exploited vulnerabilities (KEV). That said, Ninja Forms has previously had a separate file-upload flaw exploited in the wild after disclosure, so don't get complacent. WordPress plugins have seen a wave of flaws in the same period; our roundup of popular-plugin vulnerabilities and roundup of July's critical flaws can help you avoid missing an update.

FAQ

Summary

Ninja Forms, a WordPress form-builder used on 600,000+ sites, has two flaws rated 9.3. CVE-2026-65048 needs no login: it plants a malicious script via a form submission that can take over an administrator from the dashboard. CVE-2026-65049 lets a low-privilege admin on a multisite bulk-delete every site's form data. Sites with public forms are especially exposed, because the everyday act of reviewing submissions can be the trigger.

The fix is to update to 3.14.9 or later (latest 3.14.10). It takes a few clicks from "Plugins" in the WordPress admin; confirm the version afterward and you're done. No real-world attacks are confirmed yet, but Ninja Forms has been abused before and becomes an easier target once a fix ships, so if you run a form, update now.

Sources

• ▸ NVD - CVE-2026-65048 (Ninja Forms unauthenticated stored XSS)
• ▸ NVD - CVE-2026-65049 (Ninja Forms broken authorization, bulk data deletion)
• ▸ WordPress.org - Ninja Forms changelog (fix 3.14.9 / latest 3.14.10)
• ▸ Wordfence Intelligence - Ninja Forms vulnerabilities
• ▸ Patchstack - Ninja Forms vulnerability database
• ▸ Related: WordPress core site-takeover flaw, wp2shell (this site)
• ▸ Related: WordPress popular-plugin vulnerability roundup (this site)