CVE-2025-49393

Name of the Vulnerable Software and Affected Versions Sign-up Sheets versions prior to 2.3.3

Description The Sign-up Sheets plugin for WordPress allows PHP Object Injection due to the deserialization of untrusted data. This issue enables unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to execute arbitrary code) is present in the software itself, the presence of a POP chain via another installed plugin or theme could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update the plugin to a version newer than 2.3.2.