CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
Unauthenticated attackers can forge spin results to disclose and drain stored coupon codes from any campaign in the Spin Wheel WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-106031?
CVE-2026-106031 is a medium-severity vulnerability in Unknown Spin Wheel, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Weakness: CWE-284
Which versions are affected by CVE-2026-106031?
How do I fix CVE-2026-106031?
No fix has been published for CVE-2026-106031 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-106031 being exploited?
There is no known exploitation of CVE-2026-106031 in the wild and no public exploit code.
Sources
Also known as GHSA-mv9f-x7wq-j2c6.