LiveActive security incident?Get immediate response
CVE Record

CVE-2026-0808: Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter

The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-0808 affects the WordPress Spin Wheel plugin up to version 2.1.0. The plugin reportedly trusts a visitor-controlled prize value, allowing unauthenticated users to choose higher-value prizes instead of receiving a truly randomized result. The main business risk is coupon, promotion, or reward abuse, not system takeover.

Executive priority

Prioritize for marketing, ecommerce, and lead-generation sites where prizes have financial value. This is not a server-compromise issue, but it can directly affect revenue, promotion integrity, and customer trust if valuable rewards are issued automatically.

Technical view

The issue is CWE-602: client-side enforcement of server-side security. The vulnerable AJAX flow accepts a client-supplied 'prize_index' without adequate server-side validation or randomization, enabling integrity impact. CVSS is 5.3, network-accessible, low complexity, unauthenticated, with low integrity impact and no cited confidentiality or availability impact.

Likely exposure

Exposure is likely limited to WordPress sites running Spin Wheel versions up to and including 2.1.0, especially where the wheel grants coupons, discounts, leads-based rewards, or other monetary incentives. Sites not using this plugin are not affected based on the provided sources.

Exploitation context

The sources describe unauthenticated manipulation of prize selection data. CISA KEV status is false in the provided bundle, and no cited source states active exploitation. Practical impact depends on the value and enforceability of prizes issued through the plugin.

Researcher notes

The CVE record, Wordfence entry, and WordPress Trac references support the core finding. The source bundle names affected versions through 2.1.0 but does not clearly state a fixed version. Avoid assuming remediation beyond checking current vendor guidance and the referenced code changes.

Mitigation direction

  • Identify all WordPress sites using the Spin Wheel plugin.
  • Check whether installed versions are 2.1.0 or earlier.
  • Review vendor or WordPress plugin guidance for a fixed release.
  • Temporarily disable reward issuance if high-value prizes are exposed.
  • Monitor coupon and prize redemption for abnormal high-value wins.

Validation and detection

  • Confirm plugin name and version from WordPress inventory.
  • Review Spin Wheel configuration for valuable coupons or rewards.
  • Verify prize selection is determined server-side, not trusted from the browser.
  • Check application logs for unusual prize redemption patterns.
  • Track the referenced WordPress changeset and vendor advisory for remediation details.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-602: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-0808 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2026-0808Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
bdthemesSpin Wheel – Interactive spinning wheel that offers coupons0unaffected
Weakness

CWE details

CWE-602

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.