CVE-2026-65049: Ninja Forms Multisite Flaw Enables Network-Wide Data Deletion

A critical (CVSS 9.3) incorrect-authorization vulnerability (CVE-2026-65049) in the Ninja Forms WordPress plugin allows a subsite administrator on WordPress Multisite to trigger a network-level migration/cleanup function without proper privilege checks, enabling deletion of all Ninja Forms forms, submissions, and settings across the entire multisite network. The report covers technical root cause, attack chain, affected scope, remediation steps (update to >3.14.8, audit admins, backups), detection indicators, and mitigation recommendations.