CVE-2025-14509

Name of the Vulnerable Software and Affected Versions Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress versions up to and including 1.1.13

Description The software contains a PHP Code Injection issue stemming from the use of eval() to process user-provided input from the 'Conditional Tags' setting without sufficient validation or sanitization. This allows authenticated attackers with Administrator-level access or higher to execute arbitrary PHP code on the server. In WordPress multisite setups, Site Administrators can execute arbitrary code, which is not expected behavior given that plugin/theme file editing is typically restricted for non-Super Admins.

Recommendations Update Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress to a version later than 1.1.13.