CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
Explanation of Vulnerability in Simple Terms
Spin Wheel versions 2.1.0 and earlier contain an integrity vulnerability that allows network-based modification of data without authentication. The vulnerability requires no user interaction and affects the application's data integrity. Site administrators should update to a version newer than 2.1.0 to remediate this issue.
What an attacker can do
Modify application data or settings without authentication.
Potential impact on your site
Attackers can alter coupon data, wheel settings, or other application state without logging in.
Conditions required to exploit
Network access to the affected site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
