The Lucky Wheel for WooCommerce – Spin a Sale plugin is vulnerable to PHP code injection caused by using eval() on unsanitized user input from the Conditional Tags setting. This flaw allows authenticated administrators to run arbitrary PHP code on the server, effectively compromising confidentiality, integrity, and availability of the site. The weakness is a classic code injection, classified as CWE-94.

WordPress sites running the Lucky Wheel for WooCommerce – Spin a Sale plugin up to and including version 1.1.13 are affected. All installations of this plugin on both single‑site and multisite environments where the plugin is enabled are at risk. Administrators or Super Admins with access to the plugin settings can exploit the flaw.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score indicates the likelihood of exploit in the wild is lower than 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers must possess administrator‑level credentials, but once they do, invocation of the eval() construct enables remote code execution on the server, making this a critical security risk for vulnerable sites.