Vulnerabilities / Giveaways and Contests by RafflePress / WPSEC-2026-2581
Giveaways and Contests by RafflePress <= 1.12.27 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Giveaway List
Medium 4.3
CWE-200Fixed in 1.12.28
- ID
- WPSEC-2026-2581
- Plugin
- Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers (rafflepress)
- Affected
- all versions before 1.12.28
- Remediation
- Update to 1.12.28 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Giveaways and Contests by RafflePress on WPSec AttackSurface
- Fix released
- Published
Description
The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Sensitive Information Exposure via the RafflePress block editor giveaway list in all versions up to, and including, 1.12.27, due to the rafflepress_enqueue_block_editor_assets() function selecting every column of every giveaway, including the full giveaway settings, and localizing it into the block editor page. This makes it possible for authenticated attackers, with Contributor-level access and above, to read server-side giveaway settings such as the configured reCAPTCHA secret key.
References
- https://wpsec.com/vuln/WPSEC-2026-2581/
- https://plugins.svn.wordpress.org/rafflepress/tags/1.12.28/
- https://wordpress.org/plugins/rafflepress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS