{“lastseen”:””,”description”:”The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the ‘prize_index’ parameter sent to the server, allowing them to always select the most valuable prizes.”,”published”:”2026-01-17T06:42:20.697Z”,”modified”:”2026-01-17T06:42:20.697Z”,”type”:”cve”,”title”:”Spin Wheel \\u003c= 2.1.0 – Unauthenticated Client-Side Prize Manipulation via ‘prize_index’ Parameter”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/c023b91e-f633-41a6-b2d7-bcb3f1d026b7?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/spin-wheel\/trunk\/includes\/class-swp-ajax.php#L73\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/spin-wheel\/tags\/2.0.2\/includes\/class-swp-ajax.php#L73\\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=\\u0026sfph_mail=\\u0026reponame=\\u0026old=3437726%40spin-wheel\\u0026new=3437726%40spin-wheel\\u0026sfp_email=\\u0026sfph_mail=”,”id”:”CVE-2026-0808″,”bulletinFamily”:””,”cwe”:[“CWE-602″],”cvelist”:null,”sourceData”:”bdthemes Spin Wheel \u2013 Interactive spinning wheel that offers coupons *”,”sourceHref”:””,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Spin Wheel \u2013 Interactive spinning wheel that offers coupons”,”version”:”*”,”vendor”:”bdthemes”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,22,12,21,13,7,11,5],"class_list":["post-36149","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n