CVE-2026-0808

The record

The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.

Affected packages

Related vulnerabilities

• CVE-2026-89175 Smart Video Intercom System developed by Kingdom Communication Associated has a… CWE-602
• CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to… CWE-602
• CVE-2026-84841 A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. CWE-602
• CVE-2026-77793 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price… CWE-602
• CVE-2026-84110 A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. CWE-602
• CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms… CWE-602
• CVE-2026-45274 MyBooks is anebook management web server also known as Talebook. CWE-602
• CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms <… CWE-602