Authorization Flaw in Wired Impact Volunteer Management Plugin by WordPress
CVE-2026-16546
What is CVE-2026-16546?
The Wired Impact Volunteer Management plugin for WordPress, prior to version 2.8.2, contains an authorization flaw in one of its AJAX actions. This vulnerability allows authenticated users with minimal roles, such as Subscribers, to remove RSVPs associated with any volunteer opportunities regardless of ownership. This unchecked access can lead to improper management of volunteer responses, potentially disrupting the intended functionality of the plugin and leading to unauthorized actions by users. Users are encouraged to update to the latest version to mitigate this risk.
Affected Version(s)
Wired Impact Volunteer Management 0 < 2.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.