CVE-2026-16546

The Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2 ) is vulnerable to an authorization bypass in its AJAX actions . Specifically, the wivm_remove_rsvp action fails to verify if the RSVP being removed belongs to the requesting user. This allows any user with a role as lo...