# Giveaways and Contests by RafflePress <= 1.12.27 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Giveaway List

- **ID:** WPSEC-2026-2581
- **Plugin:** Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers (`rafflepress`), https://wordpress.org/plugins/rafflepress/
- **Affected versions:** all versions before 1.12.28
- **Fixed in:** 1.12.28 (Update to 1.12.28 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rafflepress
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2581/

## Description

The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Sensitive Information Exposure via the RafflePress block editor giveaway list in all versions up to, and including, 1.12.27, due to the rafflepress_enqueue_block_editor_assets() function selecting every column of every giveaway, including the full giveaway settings, and localizing it into the block editor page. This makes it possible for authenticated attackers, with Contributor-level access and above, to read server-side giveaway settings such as the configured reCAPTCHA secret key.

## References

- https://wpsec.com/vuln/WPSEC-2026-2581/
- https://plugins.svn.wordpress.org/rafflepress/tags/1.12.28/
- https://wordpress.org/plugins/rafflepress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2581/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.