CVE-2026-106031

{
  "etk_id": "ETK-2026-1939",
  "cve_id": "CVE-2026-106031",
  "display_id": "CVE-2026-106031",
  "ghsa_id": "GHSA-mv9f-x7wq-j2c6",
  "euvd_id": "EUVD-2026-101851",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated coupon redemption in Spin Wheel",
  "summary": "Spin Wheel versions before 2.2.1 do not properly validate spins before returning and consuming campaign coupon codes. An unauthenticated attacker can expose and exhaust stored codes, including those associated with unpublished campaigns, without first completing a legitimate spin.",
  "mitigation": "Upgrade the Spin Wheel WordPress plugin to version 2.2.1 or later. Until upgraded, restrict public access to affected sites or disable campaigns containing coupon codes.",
  "vendor": null,
  "product": "Spin Wheel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.2.1"
      ],
      "package_name": "Spin Wheel",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 6.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss_score": 0.0016,
  "epss_percentile": 0.0537,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 27.741414283333334,
  "t0_at": "2026-10-15T06:00:13.895000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T06:41:23.508622+00:00",
      "days": 3.0285834909953704,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T06:00:13.895000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T06:00:13.895000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T06:00:13.895000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106031"
    }
  }
}