CVE-2026-24997: 
WordPress vulnerability analysis and mitigation

CVE-2026-24997 is a Missing Authorization vulnerability in the Wired Impact Volunteer Management WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 2.8 (inclusive). The vulnerability was published on February 3, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability allows exploitation of incorrectly configured access control security levels within the plugin's functionality (Feedly).

Successful exploitation results in a limited integrity impact — attackers can perform unauthorized actions within the plugin without any confidentiality or availability consequences. The scope is unchanged, meaning the impact is confined to the vulnerable component itself. While the impact is relatively contained, unauthorized modification of volunteer management data (e.g., sign-ups, schedules, or records) could disrupt organizational operations for sites relying on this plugin (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the Wired Impact Volunteer Management WordPress plugin to a version beyond 2.8 that addresses this access control flaw. As an interim measure, site administrators can restrict access to the plugin's functionality via WordPress role and capability management, or temporarily disable the plugin if it is not critical. Monitor the WordPress plugin repository and the vendor's release notes for a patched version (Patchstack).