WooCommerce Lucky Wheel CVE-2025-14509

Requires authenticated access at WordPress Administrator level or above (PR:H) and the Lucky Wheel for WooCommerce plugin version ≤1.1.13 installed. The specific prerequisite is the ability to set the plugin's 'Conditional Tags' configuration value, which is then passed to eval(). The main limiting factor is the Administrator privilege requirement - on single-site installs such a user typically already has code-execution capability via the file editor, so the practical escalation is marginal there; the meaningful exposure is in multisite environments where Site Administrators are intentionally barred from editing plugin/theme files, making this a privilege-boundary bypass. No user interaction is needed once the setting is saved.

This is a genuine remote code execution flaw (CWE-94) but its real-world priority is tempered by a high privilege requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms network vector, low complexity, no user interaction, and full confidentiality/integrity/availability impact - but PR:H means the attacker must already hold Administrator-level access. On a standard single-site WordPress install, an administrator can normally already edit plugin/theme files and achieve code execution, so this vulnerability adds little marginal risk there; its true significance is in the multisite scenario the description calls out, where Site Administrators are deliberately denied file-editing yet can abuse the eval() sink to cross that privilege boundary. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, which is consistent with a hard-to-reach, admin-gated bug that mass-exploitation tooling would not target. No SSVC decision data was supplied. No conflicting signals were found: the description (admin-level) and the CVSS PR:H are in agreement, unlike many Wordfence advisories.

An attacker who has obtained WordPress Administrator (or, in multisite, Site Administrator) credentials navigates to the Lucky Wheel plugin settings and enters crafted PHP into the 'Conditional Tags' field, which is passed to eval() at frontend/frontend.php line 127 without sanitization. When the relevant frontend logic executes, the attacker's PHP runs on the server, yielding full code execution. No public proof-of-concept is currently identified, and exploitation requires pre-existing high privileges.