CVE-2024-13316 in Scratch and Win Plugin
Summary
by MITRE • 02/18/2025
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2025
The vulnerability identified as CVE-2024-13316 affects the Scratch & Win plugin for WordPress, specifically targeting versions up to and including 2.8.0. This plugin is designed to enhance user engagement through giveaways and contests while simultaneously boosting subscriber acquisition, traffic generation, and sales conversion. The flaw resides within the apmswn_create_discount() function which fails to implement proper capability validation, creating a critical security gap that allows unauthenticated attackers to exploit the system. The absence of authentication checks means that any user, regardless of their privileges or login status, can execute the coupon creation functionality, fundamentally undermining the plugin's intended access controls.
From a technical perspective, this vulnerability represents a classic authorization flaw that aligns with CWE-863, which describes "Incorrect Authorization" in software systems. The missing capability check indicates that the plugin does not properly verify whether the requesting user possesses the necessary permissions to perform administrative actions such as coupon creation. This type of vulnerability typically occurs when developers assume that certain functions should only be accessible to authenticated administrators while failing to implement explicit permission validation. The flaw allows attackers to bypass standard WordPress user authentication mechanisms and directly invoke the discount creation endpoint, effectively enabling privilege escalation without proper credentials.
The operational impact of this vulnerability extends beyond simple unauthorized coupon creation, as it provides attackers with the ability to manipulate the plugin's core functionality. Unauthenticated users can generate promotional codes that may be used to gain unauthorized access to premium features, manipulate contest outcomes, or potentially exploit the plugin's integration with other systems. The implications are particularly concerning for e-commerce environments where such coupons could be used to obtain free products, discount codes, or other valuable resources. Additionally, the vulnerability may enable attackers to create spam or malicious coupons that could be used for further exploitation, potentially leading to broader security incidents within the WordPress installation.
Security practitioners should consider this vulnerability in the context of the MITRE ATT&CK framework, specifically under the T1078 technique for Valid Accounts and T1566 for Phishing. The lack of proper access controls creates opportunities for attackers to establish persistent access patterns through the creation of unauthorized promotional materials. Organizations should implement immediate mitigations including updating to the latest plugin version, reviewing existing coupons for unauthorized usage, and monitoring plugin access logs for suspicious activities. The recommended remediation involves implementing proper capability checks using WordPress's built-in permission functions such as current_user_can() to ensure that only users with appropriate administrative privileges can execute the discount creation functionality. Additionally, implementing rate limiting on coupon creation endpoints can help prevent abuse while maintaining legitimate functionality for authorized users.