Security Alert Summary
The Spin Wheel plugin for WordPress (all versions up to and including 2.1.0) contains a client-side prize manipulation vulnerability. The plugin trusts client-supplied prize selection data, allowing unauthenticated attackers to modify the prize_index parameter and choose higher-value prizes without server-side validation or randomization.
CVE Details
- CVE ID: CVE-2026-0808
- Affected plugin / component: Spin Wheel plugin for WordPress
- Affected versions: All versions up to, and including, 2.1.0
- Published: January 17, 2026 at 7:16:02 AM
- Last modified: January 17, 2026 at 7:16:02 AM
- CVSS v3.1: Base Score 5.3, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction:
- Privileges Required: NONE (unauthenticated)
- User Interaction: NONE
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW
- Availability: NONE
- CWE / weakness: CWE-602
- Fixed version: Not specified in the CVE entry
Technical Details
The vulnerability exists because the plugin relies on client-supplied data to determine the prize outcome instead of enforcing server-side validation or server-side randomization. Specifically, an attacker can modify the prize_index parameter sent to the server and thereby control which prize the server records as the winner. Because the server accepts the provided index without verifying it or applying its own randomness, an unauthenticated actor can repeatedly select higher-value prizes.
The issue is described as client-side prize manipulation; the root cause is the lack of server-side checks or independent determination of prize selection. The CVE description indicates trust in client-supplied prize selection data as the primary weakness.
How This Could Impact Your Website
Consider a small business running a promotional spin-the-wheel campaign to distribute discounts or physical prizes. The site owner configures the promotion and marketing staff add prizes and tracking, while external contractors or guests may interact with the promotion via the public site. An unauthenticated attacker can modify the prize_index parameter to consistently claim the most valuable prize. Practical consequences include unexpected giveaway redemptions, inventory loss, inaccurate promotional metrics, and damaged customer trust if legitimate participants are deprived of advertised prizes.
The vulnerability does not disclose user data (confidentiality impact is stated as NONE), but it does affect the integrity of prize outcomes (integrity impact LOW). If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and permissions, especially for contributors or accounts that can modify promotional content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and minimize the number of plugins that handle transactional or promotional logic.
- Monitor site activity and promotional redemptions for unusual patterns, such as repeated high-value prize claims from a single IP or session.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/spin-wheel/tags/2.0.2/includes/class-swp-ajax.php#L73
- https://plugins.trac.wordpress.org/browser/spin-wheel/trunk/includes/class-swp-ajax.php#L73
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3437726%40spin-wheel&new=3437726%40spin-wheel&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c023b91e-f633-41a6-b2d7-bcb3f1d026b7?source=cve
