CVE-2026-106031
Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
Published Oct 15, 2026 · updated Oct 15, 2026 · Unknown Spin Wheel
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Oct 15, 2026 · NIST NVD
Updated
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Affected
- vendor Unknown Spin Wheelversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-106031
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpub
vulnerability.circl.lu - CVE.orgCVE-2026-106031
Official CVE identifier
cve.org - NIST NVDCVE-2026-106031
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpu
nvd.nist.gov