Exploitable Coupon Code Flaw in Spin Wheel WordPress Plugin
CVE-2026-106031
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-106031?
The Spin Wheel WordPress plugin, prior to version 2.2.1, contains a vulnerability that permits unauthenticated users to gain unauthorized access to coupon codes tied to various campaigns. This occurs because the plugin fails to validate whether a legitimate spin was executed by the visitor before allowing access to a prize coupon, enabling attackers to potentially disclose and exhaust stored coupon codes, including those that have not yet been published.
Affected Version(s)
Spin Wheel 0 < 2.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.