Medium · 5.3 CVE-2025-49997 EUVD-2025-18901GHSA-x2gv-xg7r-vx8g

WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability

Published Jun 20, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Syed Balkhi Product: Giveaways and Contests by RafflePress

Description

Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.

Affected products

Vendor	Product	Affected	Fixed
Syed Balkhi	Giveaways and Contests by RafflePress	≤ 1.12.18	—

References

https://patchstack.com/database/Wordpress/Plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-17-broken-access-control-vulnerability?_s_id=cve vdb-entry