Description
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Published: 2026-10-15
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Title Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-15T11:01:27.444Z

Reserved: 2026-10-06T13:18:22.873Z

Link: CVE-2026-106031

cve-icon Vulnrichment

Updated: 2026-10-15T10:36:33.364Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T07:17:58.507

Modified: 2026-10-15T14:47:05.720

Link: CVE-2026-106031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T10:45:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control