CVE-2026-92410: Unknown Sign-Up Sheets

Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days.

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

Affected products

• Unknown Sign-Up Sheets: before 2.4.0 (fixed in 2.4.0)

Published 2026-09-20. Last modified 2026-09-21.