CVE-2025-26996

Vulnerability

A code injection vulnerability exists in the Sign-up Sheets plugin for WordPress, affecting versions from n/a through 2.3.0.1. The issue stems from improper control of code generation, allowing injection of malicious code via plugin settings or input fields [1].

Exploitation

An attacker with authenticated access, such as a contributor or higher role, can exploit this by crafting input that bypasses sanitization, leading to code execution. The exact attack vector is not publicly detailed, but the vulnerability is classified as code injection [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the server, potentially leading to full site compromise, data theft, or further malicious activities [1].

Mitigation

The vendor has released version 2.3.4, which likely addresses this vulnerability. Users should update to the latest version immediately [1]. If update is not possible, consider disabling the plugin until a patch can be applied.