The vulnerability originates from a missing authorization and nonce verification in the "bulk_actions" function of the Ninja Forms – Save Progress plugin. Because the check for user capabilities is absent, any authenticated user with subscriber-level access or higher can submit a request to the plugin’s AJAX endpoint and delete arbitrary records from the wp_nf3_objects table. This allows attackers to remove stored form submissions or other plugin data, resulting in loss of data that may contain sensitive user input.

WordPress sites employing Saturday Drive’s Ninja Forms – Save Progress plugin, specifically versions 3.0.30 and earlier. Site administrators should verify the installed version and update when necessary. The vulnerability is limited to sites where the plugin is active and the bulk_actions AJAX handler is reachable through the web interface.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user leveraging the plugin’s admin‑ajax.php endpoint, so the risk manifests only to logged‑in users at subscriber level or above. While the flaw does not permit remote code execution, the ability to delete arbitrary plugin data can undermine data integrity and operational continuity.