The Lucky Draw Contests WordPress plugin is vulnerable to a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in misc-settings.php. An attacker who can persuade a site administrator to click a crafted link or submit a forged form can update the plugin’s settings without authentication. This can lead to unauthorized configuration changes, potentially disrupting the site’s operation or enabling further malicious activity such as disseminating spam content or exposing sensitive data, depending on the modified settings.

The affected product is Lucky Draw Contests, currently maintained by the vendor owais4377. All WordPress sites running any version of the plugin up to and including 4.2 are vulnerable. No specific sub‑versions are listed, so the entire <=4.2 range is considered at risk.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack path requires an unauthenticated attacker to deceive an authenticated administrator into executing a forged request, typically via a malicious link or embedded form. Once the request is accepted, the attacker can change any configuration that the administrator normally controls.