PHP Code Injection Vulnerability in Lucky Wheel for WooCommerce by Lucky Wheel

CVE-2025-14509

What is CVE-2025-14509?

The Lucky Wheel for WooCommerce plugin is susceptible to PHP code injection due to improper handling of user-supplied input within the 'Conditional Tags' setting. The use of the eval() function without adequate validation or sanitization allows authenticated users with Administrator privileges to execute arbitrary PHP code on the server. This vulnerability poses a significant risk, particularly in multisite installations where Site Administrators can exploit this flaw to gain unauthorized access and manipulate the site's functionality.

References