Spin Wheel CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Spin Wheel CVE published 2026-10-15

CVE-2026-106031

CVE-2026-106031 debrief based on CVE Program and NVD records. The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones. This vulnerability impacts campaign integrity and req [truncated]