The vulnerability is a Missing Authorization flaw in the Scratch & Win – Giveaways and Contests WordPress plugin. It allows a user who should not have privileged access to execute actions that are intended only for authorized roles. This could lead to unauthorized modification of giveaway settings, creation of contests, or other administrative functions that compromise the integrity of the site’s content and user experience.

The affected product is the Scratch & Win – Giveaways and Contests plugin for WordPress, versions up to and including 3.0.2. The vendor is Apps Mav, which provides the plugin under the name scratch-win-giveaways-for-website-facebook.

The CVSS score of 7.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation yet. However, the flaw permits elevated privileges without proper authorization and can be exploited when the plugin is accessible to unauthenticated users or improper role checks are in place. The risk remains significant, especially for sites running the vulnerable version without additional access controls.