EUVD-2026-52599
GHSA-32f3-4hg9-xrh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable AJAX endpoint requires only Subscriber authentication (PR:L); no confidentiality or availability impact, integrity limited to RSVP record deletion.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
AnalysisAI
Missing authorization in the Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2) allows any authenticated WordPress user with at least a Subscriber role to remove RSVPs belonging to other users from any volunteer opportunity. The vulnerability stems from an AJAX action handler that neither verifies the requesting user's authorization level nor confirms ownership of the RSVP being deleted, enabling unauthorized data manipulation across the entire volunteer management system. A publicly available proof-of-concept exists via WPScan, though EPSS sits at 0.13% (3rd percentile) and SSVC confirms no active exploitation, suggesting limited real-world attacker interest at this time.
Technical ContextAI
The vulnerability resides in a WordPress AJAX action registered by the Wired Impact Volunteer Management plugin (CPE: cpe:2.3:a:unknown:wired_impact_volunteer_management:*:*:*:*:*:*:*:*). WordPress AJAX handlers registered via wp_ajax_ or wp_ajax_nopriv_ hooks must independently enforce authorization checks; WordPress itself does not automatically gate these on user roles or object ownership. The root cause is CWE-862 (Missing Authorization): the plugin performs the RSVP deletion without confirming that the authenticated user holds a sufficient role or that the targeted RSVP record belongs to them. This is a classic insecure direct object reference (IDOR) pattern within a CWE-862 context - the plugin accepts an RSVP identifier from user input and acts on it without ownership validation.
RemediationAI
The primary remediation is to update the Wired Impact Volunteer Management WordPress plugin to version 2.8.2 or later, which introduces the missing authorization checks. The update can be applied through the WordPress admin dashboard under Plugins > Updates, or via WP-CLI with 'wp plugin update wired-impact-volunteer-management'. If immediate patching is not feasible, a compensating control is to temporarily restrict site registration and remove the Subscriber role from any untrusted user accounts, limiting who can reach the vulnerable AJAX endpoint; note this may impact legitimate volunteer self-registration workflows. Alternatively, a WAF rule blocking AJAX requests to the specific action from non-admin users can mitigate exposure, though the exact action name would need to be confirmed from plugin source. Advisory references: https://wpscan.com/vulnerability/7541bc1a-a4ea-4e02-b10a-ea59708159f4/
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today