The Spin Wheel WordPress plugin accepts a client‑supplied 'prize_index' parameter without applying any server‑side validation, representing a CWE‑602 weakness. A malicious user can modify this parameter and subsequently receive the most valuable prize, effectively circumventing the intended random reward mechanism. The vulnerability results in misuse of the plugin’s functionality, granting attackers unintended benefits while compromising the fairness of the system.

WordPress sites running the Spin Wheel plugin from bdthemes, specifically versions 2.1.0 and earlier. Users who deploy these versions are susceptible to prize manipulation.

With a CVSS score of 5.3, the vulnerability is considered moderate. The EPSS score of less than 1% implies a low probability of widespread exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation requires only the ability to send HTTP requests to the plugin’s AJAX endpoint, which is publicly accessible, so attackers can craft a request manipulating the 'prize_index' parameter with minimal effort.