CVE-2026-92410

Name of the Vulnerable Software and Affected Versions Sign-up Sheets versions prior to 2.4.0

Description The Sign-up Sheets WordPress plugin fails to properly validate the CSRF nonce protecting the sign-up deletion action. This allows an attacker to delete sign-up records by sending a forged request that is executed within the session of a logged-in user who possesses the necessary permissions. CSRF (Cross-Site Request Forgery) is a technique where a malicious actor tricks a user's browser into performing an unwanted action on a different website where the user is authenticated.

Recommendations Update Sign-up Sheets to version 2.4.0 or later.