What is the CVSS score of CVE-2026-0808?

CVE-2026-0808 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-0808?

Organizations using Spin Wheel should be aware of moderate risk from CVE-2026-0808 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-0808?

Within 30 days: Identify affected systems running Wheel plugin for WordPress is vulnerable to client-side priz and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-0808

MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-01-17 security@wordfence.com

WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 17, 2026 - 07:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.

AnalysisAI

The Spin Wheel WordPress plugin through version 2.1.0 fails to validate prize selection on the server side, allowing unauthenticated attackers to manipulate the 'prize_index' parameter and arbitrarily select high-value prizes. This input validation flaw enables attackers to bypass the intended randomization mechanism and consistently win premium rewards. No patch is currently available for affected installations.

Technical ContextAI

Affects Spin Wheel (WordPress plugin). The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.

Affected ProductsAI

Vendor: WordPress. Product: Spin Wheel (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in WordPress

View all

CVE-2016-10045 CRITICAL Act Now POC

9.8 Dec 30

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-8353 CRITICAL Act Now POC

9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2020-36847 CRITICAL Act Now POC

9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-11749 CRITICAL Emergency POC

9.8 Nov 05

The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-3495 CRITICAL Emergency POC

9.8 May 22

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete

Same weakness CWE-602 – Client-Side Enforcement of Server-Side Security

View all

CVE-2025-51682 CRITICAL POC

9.8

CVE-2025-32808 HIGH POC

7.7

CVE-2020-8162 HIGH POC

7.5

CVE-2022-3308 HIGH POC

7.4

CVE-2026-30521 MEDIUM POC

6.5

CVE-2026-30522 MEDIUM POC

6.5

CVE-2023-42787 MEDIUM POC

6.5

CVE-2022-3310 MEDIUM POC

6.5

CVE-2026-0808 vulnerability details – vuln.today

Back

WordPress CVE-2026-0808

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

More in WordPress

Same weakness CWE-602 – Client-Side Enforcement of Server-Side Security

Share

External POC / Exploit Code