The Spin Wheel WordPress plugin before 2.2.1 fails to verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, enabling unauthenticated users to forge spin results and expose the stored coupon codes of any campaign, including unpublished ones. This flaw allows an attacker to acquire coupon codes that could be redeemed for discounts or free products, thereby compromising the confidentiality of promotional material and potentially leading to revenue loss. The weakness corresponds to improper authorization and information exposure weaknesses.

The vulnerable component is the Spin Wheel plugin for WordPress. Versions prior to 2.2.1 are affected. Because the CNA lists the vendor as Unknown, the product name is Spin Wheel. The vulnerability applies to all users who can access the plugin’s public spinning functionality without authentication.

The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, indicating no documented exploitation so far. However, the attack path is straightforward: an unauthenticated visitor can submit a crafted request to the plugin’s spin endpoint without authentication, triggering the disclosure. The lack of any authentication or verification step gives an attacker a high likelihood of successful exploitation, especially if the website allows unrestricted access to the plugin’s functionality. The potential impact is significant due to the exposure of valuable coupon codes.