Lucky Wheel Giveaway WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Lucky Wheel Giveaway plugin for WordPress, affecting all versions up to and including 1.0.22. The vulnerability arises from the plugin's use of PHP's eval() function to process user-controlled input via the conditional_tags parameter, without adequate validation or sanitization. This flaw allows authenticated attackers with Administrator-level access to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

Users can update to version 1.0.23 or a newer patched version to address this vulnerability.