Technical impact
The Wired Impact Volunteer Management plugin lacks proper authorization checks for its AJAX action that removes RSVPs, representing a CWE‑862 Missing Authorization weakness. An attacker who has authenticated with a role as low as Subscriber can delete any RSVP attached to any volunteer opportunity, causing loss of data and potential disruption to volunteer coordination. The primary impact is integrity breach of RSVP data, which could also affect availability of volunteer records.
Affected Systems
WordPress sites that run Wired Impact Volunteer Management before version 2.8.2 are affected. The vulnerability exists regardless of WordPress core version but applies solely to the plugin files that implement the wivm_remove_rsvp action.
Risk and Exploitability
The EPSS score is <1% and the issue is not listed in CISA KEV, indicating that there is no known exploitation activity at the time of this analysis. The attack requires the victim to be authenticated; therefore the risk is moderate, but the lack of public exploits suggests a low probability of widespread attacks. The CVSS score is 4.3, so risk assessment must consider a low to moderate severity while noting that any authenticated user can delete arbitrary RSVP data.
