CVE-2026-16546: 
WordPress vulnerability analysis and mitigation

CVE-2026-16546 is a Missing Authorization (CWE-862) vulnerability in the Wired Impact Volunteer Management WordPress plugin that allows authenticated users with as low as Subscriber-level access to remove arbitrary users' RSVPs from any volunteer opportunity. The vulnerability affects all plugin versions before 2.8.2 and was publicly disclosed on July 27, 2026, with NVD publication on August 4, 2026. It carries a CVSS score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing authorization check (CWE-862) in the plugin's wivm_remove_rsvp AJAX action, which also fails to verify that the RSVP being removed belongs to the requesting user. This falls under OWASP Top 10 A5: Broken Access Control. Any authenticated WordPress user with a Subscriber role or higher can craft an AJAX request targeting this action and supply an arbitrary RSVP identifier to delete records belonging to other users. A proof-of-concept is scheduled for public release on August 10, 2026, per WPScan's coordinated disclosure timeline (WPScan).

Successful exploitation allows any authenticated subscriber-level user to delete volunteer RSVPs belonging to other users across any volunteer opportunity managed by the plugin, disrupting event attendance records and volunteer coordination. This is primarily an integrity impact — legitimate volunteers' participation records can be silently erased, undermining event documentation and organizational trust. There is no evidence of confidentiality or availability impact beyond the loss of RSVP data (WPScan, GitHub Advisory).

1. Reconnaissance: Identify a WordPress site running the Wired Impact Volunteer Management plugin version prior to 2.8.2. This can be done by checking the plugin's readme.txt file at /wp-content/plugins/wired-impact-volunteer-management/readme.txt or by observing plugin-specific markup in page source.
2. Obtain authenticated access: Register or log in to the target WordPress site with any account holding at least the Subscriber role.
3. Identify target RSVPs: Browse volunteer opportunity pages to identify RSVP IDs belonging to other users. These may be exposed in page source, network requests, or API responses.
4. Craft malicious AJAX request: Send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to wivm_remove_rsvp and the target RSVP ID, without any ownership verification being enforced by the server.
5. Achieve unauthorized deletion: The server processes the request without authorization checks, deleting the targeted user's RSVP from the volunteer opportunity (WPScan).

• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action=wivm_remove_rsvp from low-privileged user accounts or from accounts that do not own the targeted RSVPs.
• Application Behavior: Unexpected mass deletion or disappearance of RSVPs across multiple volunteer opportunities, particularly if correlated with a single user account's activity.
• Database: Audit of the WordPress database showing RSVP records removed in bulk or outside of normal volunteer activity patterns, especially if the deleting user ID does not match the RSVP owner.

The vendor has released version 2.8.2 of the Wired Impact Volunteer Management plugin, which addresses this vulnerability by adding proper authorization checks to the wivm_remove_rsvp AJAX action. Site administrators should update to version 2.8.2 or later immediately via the WordPress plugin dashboard. As a temporary workaround prior to patching, administrators should limit Subscriber role assignments to trusted users only and monitor RSVP activity logs for anomalous deletions (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who submitted it through WPScan's coordinated disclosure process. WPScan verified the report and coordinated a delayed PoC release (August 10, 2026) to allow site administrators time to apply the patch. No broader media coverage or notable community discussion has been identified at this time (WPScan).