{"id":"CVE-2026-97303","published":"2026-10-05T19:17:27.267","lastModified":"2026-10-06T15:04:25.990","description":"Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/scratch-win-giveaways-for-website-facebook/vulnerability/wordpress-scratch-win-giveaways-and-contests-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers with minimal privileges to bypass authorization controls and access restricted functionality within the Scratch & Win plugin, potentially leading to unauthorized data manipulation and content exposure.","exploitability":"Exploitation is relatively straightforward requiring only basic authentication and a knowledge of the plugin's access control configuration, with no additional preconditions or complex setup needed.","blast_radius":"If exploited, attackers could gain unauthorized access to giveaway entries, contest management features, and potentially manipulate user data or contest results across affected websites.","remediation":"Upgrade to version 3.0.3 or later to address the missing authorization controls in the Scratch & Win plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","access-control","web","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:59:08.015Z"}}