CVE-2026-106031
Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
Published Oct 15, 2026 · updated Oct 15, 2026 · Unknown Spin Wheel
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Oct 15, 2026 · NIST NVD
Updated
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Oct 15, 2026 · NIST NVD
Updated
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Affected
- vendor Unknown Spin Wheelversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-106031
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpub
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-106031
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-106031
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-106031
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpu
nvd.nist.gov