EUVD-2026-101851
GHSA-mv9f-x7wq-j2c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin prize endpoint over HTTP
-
ExploitRequest prize without legitimate spin
-
ExecutionServer returns stored coupon code
-
ImpactRepeat to enumerate and drain all coupons
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, user interaction, or special configuration is required (AV:N/AC:L/PR:N/UI:N): any WordPress site running Spin Wheel before version 2.2.1 with at least one spin-wheel campaign that has coupon-code prizes configured is exploitable by remote unauthenticated visitors. The core limiting factor is that the plugin does not validate that a legitimate spin occurred before returning/consuming a prize, so exploitation affects campaigns regardless of published state (including unpublished campaigns). Impact is limited to the coupon/prize feature - there is no path to code execution or broader site compromise from this flaw alone. |
| Impact | This is a medium-severity (CVSS 6.5) broken access control flaw that scores highly for reachability but modestly for impact. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack with no user interaction, which is the easy-to-exploit profile attackers favor, and publicly available exploit code (WPScan) lowers the barrier further. However, impact is bounded: C:L/I:L/A:N reflects disclosure and consumption of coupon codes only - not code execution, credential theft, or site takeover. There is no EPSS score in the input and no CISA KEV listing, so there is no evidence of active exploitation; the signals indicate an easily exploitable but limited-impact issue rather than a critical priority. The 'Authentication Bypass' tag somewhat overstates the flaw - this is improper access control / missing authorization (CWE-284), not a credential or session bypass. Net: real and worth patching promptly for sites running promotional coupon campaigns, but not a drop-everything emergency absent KEV/EPSS evidence. |
| Exploit ScenarioDerived | An attacker directly invokes the plugin's prize-return endpoint without ever performing a legitimate spin, causing the plugin to disclose and consume stored coupon codes. Because no authentication or spin verification is required (PR:N/UI:N) and public exploit code exists, an automated script can repeatedly drain every coupon from every campaign, including unpublished ones, in seconds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.
RemediationAI
Vendor-released patch: upgrade the Spin Wheel WordPress plugin to version 2.2.1 or later, which restores the missing check that a legitimate spin occurred before a prize coupon is returned and consumed; this is the primary and definitive fix and applies to both published and unpublished campaigns, so no campaign reconfiguration is required. Full details are available in the WPScan advisory at https://wpscan.com/vulnerability/51b61b2b-6bf7-4dee-be8a-907cf5071920/ and in the vendor's plugin release. Until the upgrade can be applied, the most effective compensating control is to temporarily remove or disable the coupon-code prize configuration from active and unpublished campaigns (or disable the plugin entirely), which eliminates the prize pool an attacker can drain - the trade-off is that the promotional campaign stops awarding coupons, and unpublished or draft campaigns should be explicitly checked because they are equally exposed. If coupon prizes must remain live, limit exposure by disabling/blocking direct access to the plugin's prize-issuing AJAX/REST endpoint via a WAF rule or web server rule for unauthenticated requests, accepting that legitimate visitors may be blocked from receiving prizes; there is no configuration-based fix that fully substitutes for the 2.2.1 patch. Additionally, treat coupon codes already disclosed as compromised and rotate/invalidate them with the issuing coupon system, and review campaign logs for bulk or repeated prize requests indicating prior harvesting.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spin Wheel is a WordPress plugin that implements promotional 'spin the wheel' campaigns, where visitors spin a wheel and receive a configured prize such as a coupon code. The vulnerability is a broken access control (CWE-284) issue rooted in the plugin's server-side prize-issuing logic: the endpoint that returns and consumes a configured coupon does not verify that the requesting visitor actually performed a legitimate spin before the coupon is disclosed. This is a classic missing-state/authorization-check failure rather than an injection or memory-safety bug - the trust boundary between 'is this a valid spin event?' and 'return a prize' is simply absent, so the award routine can be invoked directly. The CPE cpe:2.3:a:unknown:spin_wheel:*:*:*:*:*:*:*:* reflects that the affected component is the Spin Wheel plugin itself across all versions prior to 2.2.1, as confirmed by the EUVD affected-version range 'Spin Wheel 0 <2.2.1'. Exploitation requires only that the target site runs an affected version and has at least one campaign with coupon-code prizes configured; unpublished campaigns are equally exposed, indicating the vulnerable code path does not enforce publication status. The CVSS vector (AV:N/AC:L/PR:N/UI:N with C:L/I:L/A:N) confirms the request is network-delivered, unauthenticated, needs no user interaction, and yields low confidentiality and integrity impact without availability impact - consistent with bulk disclosure of coupon codes and consumption of prize inventory rather than site takeover.
Know when Spin Wheel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Remote unauthenticated access with no interaction (AV:N/AC:L/PR:N/UI:N); coupon disclosure gives C:L and consuming/draining coupons gives I:L, with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB