CVE-2026-97303

Summary

This vulnerability allows attackers with minimal privileges to bypass authorization controls and access restricted functionality within the Scratch & Win plugin, potentially leading to unauthorized data manipulation and content exposure.

Exploitability

Exploitation is relatively straightforward requiring only basic authentication and a knowledge of the plugin's access control configuration, with no additional preconditions or complex setup needed.

Blast radius

If exploited, attackers could gain unauthorized access to giveaway entries, contest management features, and potentially manipulate user data or contest results across affected websites.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.3 or later to address the missing authorization controls in the Scratch & Win plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.