Vulnerability · Published Oct 15, 2026 · Assigned by WPScan
CVE-2026-106031Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
Medium 6.5
In plain English
A medium-severity improper access control in Spin Wheel from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Spin Wheel | 0 – before 2.2.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/51b61b2b-6bf7-4dee-be8a-907cf5071920/ exploit, vdb-entry, technical-description