blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-15550

MEDIUM 4.3 CVSS 3.1
Published
September 5, 2026
Last modified
September 8, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.

Affected products and versions

  • Saturday Drive Ninja Forms - Save Progress — Up to and including 3.0.30

References

  • ninjaforms.com https://ninjaforms.com/extensions/save-progress/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d3e6ce-e6d7-455b-a43d-a14189b30491?source=cve
  • nvd.nist.gov Official NVD record