PT-2026-7480 · WordPress · Lucky Wheel Giveaway

Nguyen Truong · Publicado 2026-02-11 · Atualizado 2026-02-16 · CVE-2025-14541

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lucky Wheel Giveaway plugin for WordPress versions prior to 1.0.23

Description The Lucky Wheel Giveaway plugin for WordPress is susceptible to Remote Code Execution. This is due to the use of PHP’s eval() function on user-controlled input without sufficient validation or sanitization. An authenticated attacker with Administrator-level access or higher can execute code on the server through the conditional tags parameter.

Recommendations Update the Lucky Wheel Giveaway plugin to version 1.0.23 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-14541

Produtos afetados

Lucky Wheel Giveaway

Referências · 6

• https://twitter.com/cracbot/status/2023351712850038974 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3439141/wp-lucky-wheel/trunk · Nota
• https://twitter.com/VulmonFeeds/status/2021508653178605779 · Publicação no Twitter
• https://t.me/CVEtracker/44365 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-14541 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/ac0455a2-1fa8-4a37-a72f-9ed5cca1d9ee?source=cve · Nota