The vulnerability is an incorrect authorization flaw that allows any subsite Administrator on a WordPress Multisite installation to trigger a deletion routine that erases all Ninja Forms data across every site in the network. The flaw lies in the nf_delete_all_data AJAX action, which performs a site‑scoped capability check but does not restrict the action to super‑admin or network‑admin users. When an attacker crafts a POST request to admin‑ajax.php with the nf_delete_all_data action and a valid per‑site nonce, the plugin’s migration code executes unconditionally. It iterates over all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients, thereby destroying every form, submission, setting and related data.

The issue affects the Ninja Forms plugin from Saturday Drive, versions 3.14.8 and earlier, when used on WordPress Multisite networks. Users of these plugin releases are at risk if their setup allows subsite administrators to access the nf_delete_all_data AJAX endpoint.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1% shows a low but not negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet it can be exploited without requiring super‑admin level privileges; a subsite administrator has sufficient access to send the crafted request, making the attack straightforward. Once executed, the deletion affects the entire network, creating a catastrophic data loss scenario.