WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

CVE-2026-16546

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...

CVE-2026-16546

The Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2 ) is vulnerable to an authorization bypass in its AJAX actions . Specifically, the wivm_remove_rsvp action fails to verify if the RSVP being removed belongs to the requesting user. This allows any user with a role as lo...