Scratch Win Giveaways And Contests
Monthly
Missing authorization checks in the WordPress plugin 'Scratch & Win - Giveaways and Contests' (all versions through 3.0.2, vendor Apps Mav) allow an authenticated low-privilege user - for example a subscriber on a site that permits open or self-service registration - to reach plugin functionality that should be gated behind higher-privilege capabilities, resulting in high confidentiality exposure plus limited integrity and availability impact (CVSS 3.1 base 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Exploitation is network-reachable and requires no user interaction, but it is constrained by the need for a valid low-privileged account, so purely anonymous abuse is not confirmed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released fixed version appears in the available data.
Missing authorization checks in the WordPress plugin 'Scratch & Win - Giveaways and Contests' (all versions through 3.0.2, vendor Apps Mav) allow an authenticated low-privilege user - for example a subscriber on a site that permits open or self-service registration - to reach plugin functionality that should be gated behind higher-privilege capabilities, resulting in high confidentiality exposure plus limited integrity and availability impact (CVSS 3.1 base 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Exploitation is network-reachable and requires no user interaction, but it is constrained by the need for a valid low-privileged account, so purely anonymous abuse is not confirmed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released fixed version appears in the available data.