Sign-up Sheets deletion accepts forged requests in a privileged session
An attacker induces a logged-in user with the required deletion capability to send a forged sign-up deletion request. Incorrect CSRF nonce validation allows the victim's session to delete sign-up records. The attacker does not need their own authorized account, but victim authentication and interaction are required. The exact action and nonce field are not disclosed. Authoritative affected range: < 2.4.0. Confirmed remediation: 2.4.0.
- Component
- Sign-up Sheets
- Plugin slug
sign-up-sheets- Affected
- < 2.4.0
- Safe version
2.4.0- Published
- Sep 20, 2026
This CVE was published Sep 20, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 2.4.0. Require a valid action-bound nonce in addition to the deletion capability and target authorization. Avoid untrusted links or pages while administering sign-ups until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N