Lucky Wheel Giveaway <= 1.0.22 - Exécution Arbitraire de Code à Distance (Administrateur+) via le paramètre 'conditional_tags'

The impact of this vulnerability is significant. Successful exploitation allows an attacker with administrator privileges to completely compromise the WordPress instance. This could lead to data theft, website defacement, malware installation, and complete system takeover. The use of eval() on unsanitized user input is a critical security flaw, enabling attackers to inject and execute malicious PHP code. Given the plugin's functionality (giveaways), attackers could potentially leverage this to distribute malware to users participating in the giveaways, expanding the blast radius beyond the initial WordPress installation.

WordPress websites utilizing the Lucky Wheel Giveaway plugin, particularly those with administrator accounts that have not been secured with strong passwords and multi-factor authentication, are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.

• wordpress / plugin:

wp plugin list | grep "Lucky Wheel Giveaway"

• wordpress / plugin: Check plugin version.

wp plugin list --status=active --format=json | jq '.["Lucky Wheel Giveaway"].version' 

• wordpress / plugin: Examine plugin files for eval() usage without sanitization. Use grep -r eval . within the plugin directory. • generic web: Monitor access logs for requests containing suspicious PHP code in the conditional_tags parameter. Look for patterns resembling code injection attempts.

1. 2026-02-11Disclosure

   disclosure

1. Réservé2025-12-11
2. Publiée2026-02-11
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade the Lucky Wheel Giveaway plugin to version 1.0.23 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing suspicious payloads in the conditional_tags parameter could offer some protection. Monitor WordPress access logs for unusual activity, particularly requests containing PHP code snippets. Review user roles and permissions to ensure only authorized users have administrator access.

Installations actives

600

Note du plugin