CVE-2026-0808

The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.

• CWE-602

• https://plugins.trac.wordpress.org/browser/spin-wheel/tags/2.0.2/includes/class-swp-ajax.php#L73
• https://plugins.trac.wordpress.org/browser/spin-wheel/trunk/includes/class-swp-ajax.php#L73
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3437726%40spin-wheel&new=3437726%40spin-wheel&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c023b91e-f633-41a6-b2d7-bcb3f1d026b7?source=cve

Published

Jan 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0802An ACAP configuration file lacked sufficient input validatio…7.3
• CVE-2026-0803A vulnerability was found in PHPGurukul Online Course Regist…8.8
• CVE-2026-0804An ACAP configuration file lacked sufficient input validatio…7.3
• CVE-2026-0805An input neutralization vulnerability in the Backup Configur…8.8
• CVE-2026-0806The WP-ClanWars plugin for WordPress is vulnerable to SQL In…4.9
• CVE-2026-0807The Frontis Blocks plugin for WordPress is vulnerable to Ser…7.2
• CVE-2026-0809Use of a custom token encoding algorithm in Streamsoft Prest…6.3
• CVE-2026-0810A flaw was found in gix-date. The `gix_date::parse::TimeBuf:…7.1
• CVE-2026-0811The Advanced Contact form 7 DB plugin for WordPress is vulne…5.4
• CVE-2026-0812The LinkedIn SC plugin for WordPress is vulnerable to Stored…4.4
• CVE-2026-0813The Short Link plugin for WordPress is vulnerable to Stored …4.4
• CVE-2026-0814The Advanced Contact form 7 DB plugin for WordPress is vulne…4.3