Description

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T07:16:50.957Z",
  "pubdate": "2026-09-20T07:16:50.957Z",
  "executiveSummary": "The Sign-up Sheets WordPress plugin before version 2.4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability within its sign-up deletion functionality.\nThis vulnerability exists because the plugin fails to properly validate the security nonce intended to protect sensitive deletion actions.\nThe vulnerability allows a remote, unauthenticated attacker to induce a logged-in user with appropriate administrative or management capabilities to perform unauthorized actions unknowingly.\nSuccessful exploitation results in the unauthorized deletion of sign-up records, potentially leading to data loss and disruption of organizational sign-up workflows.\nThe attack requires the victim to have an active session with the WordPress instance and for that user to possess the necessary capabilities to delete sign-up data.",
  "technicalDetails": "The vulnerability stems from an improper implementation of nonce validation within the Sign-up Sheets plugin's administrative action handler responsible for processing sign-up deletions.\nIn WordPress, nonces are intended to provide protection against CSRF by ensuring that a request is originating from the expected interface. The plugin fails to adequately verify the authenticity or existence of the expected CSRF token before executing the deletion logic.\nThe attack flow begins when an attacker crafts a malicious request—typically via a hidden form submission, an image tag, or a script embedded on an external site—designed to invoke the vulnerable deletion function within the Sign-up Sheets plugin. When a user with the required privileges (such as a site administrator or editor) visits the attacker-controlled page while having an active session in the target WordPress dashboard, the browser automatically includes the user's authentication cookies with the forged request.\nBecause the server-side code does not correctly validate the CSRF nonce, the plugin treats the forged request as legitimate and proceeds to execute the deletion of the specified sign-up records.\nThis vulnerability is classified as a CSRF attack because it leverages the trust the server places in the user's browser, bypassing security constraints through the involuntary action of an authenticated user.\nThe post-exploitation impact includes the irreversible removal of sign-up data from the database, which can cause significant service disruption. Because the action is executed using the context of a legitimate user's session, the server-side logs may show the action as having been performed by the authenticated user, potentially complicating audit trails and incident response efforts.\nThe flaw affects all versions of the Sign-up Sheets plugin prior to 2.4.0. The vulnerability is triggered by direct interactions with the plugin's internal request handlers, and requires no specific network exposure beyond the standard web access already required for legitimate administrative functionality."
}