Sign-up Sheets EUVD-2026-83674

Exploitation requires a victim who is currently logged into the WordPress site AND holds the capability that authorizes sign-up-record deletion; the attacker must induce that specific user to load an attacker-controlled request (link, page, or embedded resource) - this is the UI:R constraint. It works against default configurations of Sign-up Sheets before 2.4.0 because the deletion action fails to properly validate its CSRF nonce. Limiting factors: no exploitation is possible without an authenticated, sufficiently-privileged victim taking the bait, and the impact is confined to deleting sign-up records (no data theft, code execution, or account takeover).

This is a genuinely low-priority issue despite a public POC. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3) correctly reflects a classic CSRF: no attacker authentication (PR:N) but mandatory victim interaction (UI:R) and integrity-only impact (I:L, C:N, A:N). The 'network/unauthenticated' framing is a CSRF artifact - the attacker never touches the target directly; they must lure an already-logged-in user who holds the sign-up-deletion capability into triggering a forged request. Publicly available exploit code exists (WPScan), but no EPSS score and no CISA KEV listing were provided, and POC availability is NOT evidence of active exploitation. The blast radius is narrow: only deletion of sign-up records, with no data disclosure, no code execution, and no persistence. Net: a valid-but-minor CSRF whose 4.3 base score is appropriate and not inflated. No conflicting signals were found in the input.

An attacker hosts a malicious page (or sends an email/comment) containing an auto-submitting forged request targeting the plugin's sign-up deletion endpoint. When a logged-in WordPress user who holds the required capability visits it, their authenticated session silently executes the deletion, removing sign-up records without their knowledge. A public POC for this flow exists (WPScan).