CVE-2026-16546mediumCWE-862

CVE-2026-16546: medium-severity vulnerability in Wired Impact Volunteer Management

Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

Published

Follow this CVE+ Monitor Wired Impact Volunteer Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.3epss 0.3%
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Wired Impact Volunteer Management
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.