WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 5.5 out of 10.
The most common weakness is Server-Side Request Forgery (SSRF), behind 1 of the records (50%). Other recurring categories include Storage Of Sensitive Data In A Mechanism Without Access Control.
Every one of the 2 issues recorded for WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-31824WP Optin Wheel <= 1.4.7 - Authenticated (Admin+) Server-Side Request Forgery
Read the full analysisVulnerability Records
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
Author
Maarten B
Grow your email list or grow your sales by offering your visitors a chance to win a coupon, or other prize through spinning the wheel of fortune. Users have let us know their signup rate increased with 200% after installing our spin to win plugin! This plugin could be your new favorite email marketing. Beautiful predefined themes. Capture emails into MailChimp. Create multiple wheels. Configure the chance of winning for each slice. Configure each of the wheel’s 12 slices separately. Choose between a losing slice, a discount or a link (to product/page/ebook/ …). Control when to show the popup. Compatible in any language. Complete control over the content (text, buttons, …) displayed in the popup. Ability to log wins/losses in a separate log file. GDPR-Ready. And more … Quick links » More info » Demos » Full-screen, completely custom demo (requires custom CSS) » Documentation PREMIUM FEATURES Everything from the free version, plus: Create your own theme. Start with a predefined theme and edit to your liking. Seasonal themes like Christmas & Halloween. Full WooCommerce automatic coupon integration. Form-builder: build any kind of opt-in form. Shortcode to display the wheel in any post, page, or widget. Ability to have a fullscreen popup. You can also display the wheel inside your content rather than as a popup. Coupon settings such as duration, or restriction to product/category. You can also offer a free gift. You can also offer free shipping. Compatible with WordPress, Zapier, Drip, Mailchimp, Campaign Monitor, ActiveCampaign, MailerLite, ConvertKit, Remarkety, GetResponse, Klaviyo, Mailster, SendInBlue, Newsletter2Go. Extend functionality with webhooks through Zapier, Make, IFTTT, n8n,… Allows checking players for fraud by checking email address or IP address. Validate email addresses against known fake email domains. WPML multi-language compatible. Beautiful widgets (pop outs or icons to click on to show the wheel). Offer replays. Design settings: choose a predefined theme or completely design your own. Show a coupon bar for increased urgency. Show/hide on mobile. Show/hide on certain pages. Show popup on Exit-intent. Show popup on click of a button. Integrated statistics: see how many viewed and how many opted in. Developer-friendly. And more..! Find out more about the pro version here
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C