CVE-2026-16546 — Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

CVE-2026-16546

Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp PUBLISHED

Description (CNA)

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.

Affected (CNA)

Vendor / product	Versions
Unknown / Wired Impact Volunteer Management	affected 0 before 2.8.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7541bc1a-a4ea-4e02-b10a-ea59708159f4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.