CVE-2026-92410 in Sign-up Sheets Plugin
Summary
by MITRE • 09/20/2026
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in Sign-up Sheets WordPress plugin versions prior to 2.4.0 represents a critical failure in access control mechanisms, specifically concerning Cross-Site Request Forgery protections. The core technical flaw lies in the improper validation of the CSRF nonce associated with the sign-up deletion action. In secure web application development, nonces are unique tokens generated per session or request that must be verified by the server to ensure that a state-changing request was intentionally initiated by an authenticated user and not forged by a malicious third party. The plugin fails to enforce this verification step adequately during the execution of the delete operation, leaving the functionality exposed to manipulation through crafted HTTP requests.
From an operational perspective, this flaw allows attackers to perform unauthorized deletion of sign-up records without needing direct access to the victim's account credentials or physical device. By crafting a malicious webpage or email link containing a forged request that targets the vulnerable endpoint, an attacker can trick a logged-in administrator or user with sufficient privileges into executing the delete action when they visit the malicious content. Because the browser automatically includes session cookies and authentication tokens in requests made by the authenticated user, the server processes the deletion as if it were legitimate, resulting in data loss for the organization managing these sign-ups. This constitutes an impact on both integrity and availability of the application's data assets.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), where a web application performs state-changing requests using the credentials of a trusted user without their knowledge. Furthermore, within the MITRE ATT&CK framework for enterprise security, this behavior maps to T1498.002, Network Denial of Service via Web Application Attacks, specifically under the sub-technique of resource exhaustion or data manipulation through forged requests. It also relates to CWE-639, which involves authorization bypass issues where insufficient checks allow actions that should be restricted based on user roles or permissions.
To mitigate this vulnerability, immediate action is required by upgrading the Sign-up Sheets plugin to version 2.4.0 or later, where the developers have addressed the nonce validation logic. For organizations unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall with rulesets capable of detecting and blocking anomalous POST requests lacking valid CSRF tokens can provide temporary protection. Additionally, enforcing strict session management policies, such as shorter cookie lifespans and requiring re-authentication for sensitive administrative actions like data deletion, can reduce the window of opportunity for attackers to exploit this flaw. Regular security audits focusing on input validation and state change operations are essential to prevent similar issues in future updates or other plugins within the WordPress ecosystem.