CVE-2026-0808 Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
Unauthenticated attackers can manipulate prize selection in the Spin Wheel WordPress plugin by modifying client-side parameters, bypassing intended randomization logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0808?
CVE-2026-0808 is a medium-severity vulnerability in bdthemes Spin Wheel – Interactive spinning wheel that offers coupons, published on 17 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
Weakness: CWE-602
Which versions are affected by CVE-2026-0808?
How do I fix CVE-2026-0808?
No fix has been published for CVE-2026-0808 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-0808 being exploited?
There is no known exploitation of CVE-2026-0808 in the wild and no public exploit code.
Sources
Also known as GHSA-v766-7x5c-f752.