PT-2026-7480 · WordPress · Lucky Wheel Giveaway

Nguyen Truong · CVE-2025-14541 · Published 2026-02-11 · Updated 2026-02-16

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lucky Wheel Giveaway plugin for WordPress versions prior to 1.0.23

Description The Lucky Wheel Giveaway plugin for WordPress is susceptible to Remote Code Execution. This is due to the use of PHP’s eval() function on user-controlled input without sufficient validation or sanitization. An authenticated attacker with Administrator-level access or higher can execute code on the server through the conditional tags parameter.

Recommendations Update the Lucky Wheel Giveaway plugin to version 1.0.23 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-14541

Affected Products

Lucky Wheel Giveaway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14541 · Security Note
• https://twitter.com/cracbot/status/2023351712850038974 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3439141/wp-lucky-wheel/trunk · Note
• https://twitter.com/VulmonFeeds/status/2021508653178605779 · Twitter Post
• https://t.me/CVEtracker/44365 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ac0455a2-1fa8-4a37-a72f-9ed5cca1d9ee?source=cve · Note