The Wired Impact Volunteer Management plugin lacks proper authorization checks for its AJAX action that removes RSVPs. An attacker who has authenticated with a role as low as Subscriber can delete any RSVP attached to any volunteer opportunity, causing loss of data and potential disruption to volunteer coordination. The primary impact is integrity breach of RSVP data, which could also affect availability of volunteer records.

WordPress sites that run Wired Impact Volunteer Management before version 2.8.2 are affected. The vulnerability exists regardless of WordPress core version but applies solely to the plugin files that implement the wivm_remove_rsvp action.

No EPSS score is available and the issue is not listed in CISA KEV, indicating that there is no known exploitation activity at the time of this analysis. The attack requires the victim to be authenticated; therefore the risk is moderate, but the lack of public exploits suggests a low probability of widespread attacks. The CVSS score is not provided, so risk assessment must rely on the described impact and the fact that any authenticated user can delete arbitrary data.