CVE-2026-106031: Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spin Wheelto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it; no WordPress account or legitimate wheel spin is required.
What campaign data is exposed?
Configured prize coupon codes can be disclosed and consumed for any campaign, including unpublished campaigns.
What is the impact of coupon consumption?
An attacker can drain the stored coupon codes associated with affected campaigns, potentially preventing intended visitors from receiving those codes.
Which plugin versions are affected?
Spin Wheel versions before 2.2.1 are affected.