Vulnerability · Published Feb 18, 2025 · Assigned by Wordfence
CVE-2024-13316Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation
Medium 5.3
In plain English
A medium-severity missing authorization in Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more from akashmalik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| akashmalik | Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more | 0 – through 2.8.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/95103830-9009-48df-ab15-476402b59e3f?source=cve
- https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.7.0/socialscratchwin.php#L492
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239997%40scratch-win-giveaways-for-website-facebook&new=3239997%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212730%40scratch-win-giveaways-for-website-facebook&new=3212730%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=