Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
CVE-2026-97318
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 2 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-97318?
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Affected Version(s)
Giveaways and Contests by RafflePress 0 < 1.12.27
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.