CVE-2025-14509

The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is due to the plugin using eval() to execute user-supplied input from the 'Conditional Tags' setting without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server. In WordPress multisite installations, this allows Site Administrators to execute arbitrary code, a capability they should not have since plugin/theme file editing is disabled for non-Super Admins in multisite environments.

• CWE-94

• https://plugins.trac.wordpress.org/browser/woo-lucky-wheel/tags/1.1.13/frontend/frontend.php#L127
• https://plugins.trac.wordpress.org/browser/woo-lucky-wheel/trunk/frontend/frontend.php#L127
• https://plugins.trac.wordpress.org/changeset/3428063/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9a41bc0e-0ab9-4cee-b3ca-d730c828782c?source=cve

Published

Dec 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14503An overly-permissive IAM trust policy in the Harmonix on AWS…8.6
• CVE-2025-14504IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.…5.4
• CVE-2025-14505The ECDSA implementation of the Elliptic package generates i…5.6
• CVE-2025-14506The ConvertForce Popup Builder plugin for WordPress is vulne…6.4
• CVE-2025-14507The EventPrime - Events Calendar, Bookings and Tickets plugi…5.3
• CVE-2025-14508The MediaCommander – Bring Folders to Media, Posts, and Page…6.5
• CVE-2025-1451A vulnerability in parisneo/lollms-webui v13 arises from the…7.5
• CVE-2025-14510Incorrect Implementation of Authentication Algorithm vulnera…9.2
• CVE-2025-14511GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-14512A flaw was found in glib. This vulnerability allows a heap b…6.5
• CVE-2025-14513GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-14514A flaw has been found in Campcodes Supplier Management Syste…9.8