CVE-2026-97303: Missing Authorization in Apps Mav Scratch & Win – Giveaways and Contests

This vulnerability involves missing authorization checks in the Apps Mav Scratch & Win – Giveaways and Contests plugin (versions >=0 <3.1.0). It allows attackers with limited privileges to exploit improperly configured access control mechanisms, leading to unauthorized access or actions within the application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

An attacker with low privileges can exploit this missing authorization vulnerability to gain unauthorized access or perform unauthorized actions, potentially leading to high confidentiality impact, partial integrity loss, and partial availability disruption within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to access control. Avoid granting unnecessary privileges to users interacting with the plugin.