CVE-2026-0808 affects the bdthemes Spin Wheel WordPress plugin, which offers interactive coupon prizes. The vulnerability arises because the plugin relies on client-supplied 'prize_index' data to determine prize allocation without server-side validation or randomization. This design flaw allows unauthenticated attackers to manipulate the prize selection process by modifying the 'prize_index' parameter in requests, effectively bypassing intended randomness and security controls. The issue is categorized as CWE-602, client-side enforcement of server-side security, and impacts all versions up to 2.1.0. There is no indication of known exploits in the wild or available patches as of the published date.

An attacker can exploit this vulnerability to manipulate the prize selection mechanism of the Spin Wheel plugin, allowing them to consistently obtain the most valuable prizes without authorization. This undermines the integrity of the promotional system and could lead to financial or reputational damage for the site operator. The vulnerability does not impact confidentiality or availability but results in an integrity loss. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently referenced, site administrators should monitor the vendor's communications for updates. Until a fix is available, consider disabling the Spin Wheel plugin or restricting access to it to trusted users only to prevent exploitation. Avoid relying on client-supplied data for prize determination and implement server-side validation and randomization as a best practice once a fix is applied.