Aditya Gurav

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.

**Name of the Vulnerable Software and Affected Versions** WPFunnels versions prior to 3.13.0 **Description** The plugin fails to verify if the product requested via a checkout order bump matches the product for which the discount was configured. This allows unauthenticated users to manipulate the price and obtain any purchasable product using a discount intended for a different item, which then reduces the total order price. **Recommendations** Update to version 3.13.0 or later.