Spin Wheel
Monthly
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.