CVE-2026-106031
Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
| Vendor | unknown |
| Product | spin wheel |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown spin wheel
Be the first to know when new unknown vulnerabilities affecting unknown spin wheel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Spin Wheel
0 < 2.2.1
References
Credits
Aditya Gurav WPScan