Unauthorized Access Vulnerability in Scratch & Win Plugin by WordPress
CVE-2024-13316
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 February 2025
What is CVE-2024-13316?
The Scratch & Win – Giveaways and Contests plugin for WordPress is vulnerable due to a missing capability check in the apmswn_create_discount() function across all versions up to 2.8.0. This flaw allows unauthenticated attackers to exploit the system, enabling them to create fraudulent discount coupons. Website owners using this plugin should be aware of this security issue and take immediate action to mitigate the risk.
Affected Version(s)
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more * <= 2.8.0