CVE-2026-92410: CWE-352 Cross-Site Request Forgery (CSRF) in Sign-up Sheets
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
AI Analysis
Technical Summary
The Sign-up Sheets WordPress plugin prior to version 2.4.0 contains a CSRF vulnerability (CWE-352) due to improper validation of the CSRF nonce for the sign-up deletion action. This flaw enables an attacker to craft a malicious request that, when executed by a logged-in user with the required capability, results in unauthorized deletion of sign-up records.
Potential Impact
An attacker can cause deletion of sign-up records without the consent of the authorized user by exploiting the CSRF vulnerability. This could lead to data loss or disruption of sign-up management within affected WordPress sites.
Mitigation Recommendations
Upgrade the Sign-up Sheets plugin to version 2.4.0 or later, where the CSRF nonce validation issue has been addressed. No other mitigation guidance is provided. Patch status is not explicitly confirmed by a vendor advisory, but the version 2.4.0 indicates the fix.
CVE-2026-92410: CWE-352 Cross-Site Request Forgery (CSRF) in Sign-up Sheets
Description
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
CVSS v3.1
Score 4.3medium
Affected software
Sign-up Sheets
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Sign-up Sheets WordPress plugin prior to version 2.4.0 contains a CSRF vulnerability (CWE-352) due to improper validation of the CSRF nonce for the sign-up deletion action. This flaw enables an attacker to craft a malicious request that, when executed by a logged-in user with the required capability, results in unauthorized deletion of sign-up records.
Potential Impact
An attacker can cause deletion of sign-up records without the consent of the authorized user by exploiting the CSRF vulnerability. This could lead to data loss or disruption of sign-up management within affected WordPress sites.
Mitigation Recommendations
Upgrade the Sign-up Sheets plugin to version 2.4.0 or later, where the CSRF nonce validation issue has been addressed. No other mitigation guidance is provided. Patch status is not explicitly confirmed by a vendor advisory, but the version 2.4.0 indicates the fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-16T09:05:32.493Z
- State
- PUBLISHED
Threat ID: 6aaf7de955bf5e2cf5adcfa2
Added to database: 09/20/2026, 06:32:09 UTC
Last enriched: 09/20/2026, 06:46:55 UTC
Last updated: 09/20/2026, 22:12:34 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.