The vulnerability is a code injection flaw arising from improper handling of shortcode parameters in the Sign‑up Sheets plugin. An attacker who can inject a shortcode into a post or page can cause arbitrary PHP code to be executed in the context of the WordPress site, giving them the ability to read, modify, or delete site data, or gain persistent control over the server. This is a classic code‑injection (CWE‑94) issue.

The problem exists in all releases of Fetch Designs Sign‑up Sheets up to version 2.3.0.1, including the original plugin line. Administrators must verify that their instance is running an affected version.

With a CVSS score of 6.5 and an EPSS below 1%, the likelihood of automated exploitation is low, and the vulnerability is not yet listed in CISA’s KEV catalog. However, the likely attack vector is through editing WordPress content to inject a malicious shortcode, as WordPress content can be edited by users with the capability to add shortcodes; an attacker could carry out the exploit remotely by inserting a malicious shortcode into a post, page, or widget. The vulnerability could be triggered without requiring prior user interaction beyond a content edit.