Security Alert Summary
The Sign-up Sheets plugin before 2.4.0 fails to properly validate the CSRF nonce protecting its sign-up deletion action. This weakness allows an attacker to submit a forged request that is processed inside the session of a logged-in user who has the required capability, resulting in deletion of sign-up records.
CVE Details
- CVE ID: CVE-2026-92410
- Affected component: Sign-up Sheets WordPress plugin
- Affected versions: versions before 2.4.0
- Published: September 20, 2026 at 7:16:50 AM UTC
- Last modified: September 20, 2026 at 2:16:59 PM UTC
- CVSS v3.1: Base score 4.3, Medium —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: CVSS indicates privileges required: NONE (PR:N) and user interaction: REQUIRED (UI:R). The issue is exploitable via a forged request processed in the session of a logged-in user who holds the necessary capability.
- Primary impact: Integrity: Low; Confidentiality: None; Availability: None
- CWE: CWE-352 (Cross-Site Request Forgery)
Technical Details
The plugin does not properly validate the CSRF nonce protecting its sign-up deletion action. Because the nonce check is missing or insufficient, a crafted request sent by an attacker can be executed using the browser session of a logged-in user who has the capability required to delete sign-ups. The description identifies the affected action as the sign-up deletion action and attributes the root cause to improper CSRF nonce validation.
When a vulnerable endpoint or action fails to verify the expected nonce, the server cannot distinguish legitimate user-initiated requests from forged requests. The outcome in this case is deletion of sign-up records. The available data does not name specific PHP function names or REST endpoints beyond the sign-up deletion action, and no additional code-level details are provided.
How This Could Impact Your Website
In a typical site workflow, a site owner manages plugin settings, internal staff or volunteers manage event sign-ups, and external contributors or contractors may log in to assist. An attacker could trick a logged-in staff member into visiting a page or clicking a link that submits a forged request. Because the request is processed in the staff member’s session, sign-up records could be deleted without the staff member intending to perform that action.
- Deleted sign-up records can disrupt event management and require manual recovery from backups or archives.
- Operational disruption may increase administrative overhead and confusion among staff and contributors.
- While the CVSS metrics indicate no confidentiality impact for this issue, deleted records can still cause business or operational harm and complicate workflows.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and volunteers.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual deletion actions or sudden changes to sign-up records.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
