CVE-2025-14509
Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is due to the plugin using eval() to execute user-supplied input from the 'Conditional Tags' setting without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server. In WordPress multisite installations, this allows Site Administrators to execute arbitrary code, a capability they should not have since plugin/theme file editing is disabled for non-Super Admins in multisite environments.
| CWE | CWE-94 |
| Vendor | villatheme |
| Product | lucky wheel for woocommerce – spin a sale |
| Published | Dec 30, 2025 |
| Last Updated | Apr 8, 2026 |
Get instant alerts for villatheme lucky wheel for woocommerce – spin a sale
Be the first to know when new high vulnerabilities affecting villatheme lucky wheel for woocommerce – spin a sale are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H