CVE-2026-16546
Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
| Vendor | unknown |
| Product | wired impact volunteer management |
| Published | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wired impact volunteer management
Be the first to know when new unknown vulnerabilities affecting unknown wired impact volunteer management are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Wired Impact Volunteer Management
0 < 2.8.2
References
Credits
Shikhali Jamalzade WPScan