PT-2025-6540 · WordPress · Scratch & Win – Giveaways/Contests

Peter Thaleikis

·

Published

2025-02-18

·

Updated

2025-02-18

·

CVE-2024-13316

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Scratch & Win – Giveaways and Contests plugin for WordPress versions up to, and including, 2.8.0
Description The issue is related to a missing capability check on the apmswn create discount() function, allowing unauthorized access. This enables unauthenticated attackers to create coupons.
Recommendations For versions up to, and including, 2.8.0, update to a version that includes a fix for the missing capability check in the apmswn create discount() function. As a temporary workaround, consider disabling the apmswn create discount() function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13316

Affected Products

Scratch & Win – Giveaways/Contests