Executive brief
The Sign-up Sheets WordPress plugin before version 2.4.0 fails to properly validate security tokens that protect the sign-up deletion feature. An attacker can trick a logged-in administrator into deleting sign-up records by sending them a malicious link or webpage, resulting in loss of event registration data without authorization.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in the sign-up deletion action due to insufficient CSRF nonce validation. An attacker can forge a request that, when executed in the browser session of a logged-in user with deletion capabilities, deletes arbitrary sign-up records. The vulnerability requires an authenticated user with the necessary privilege and user interaction (visiting a malicious page).
Affected products
- WordPress Sign-up Sheets before 2.4.0
Timeline
- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 2.4.0