Skip to content
Sign in
6.5 Medium

CVE-2026-97314 The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its…

Description

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

Affected products and versions

Product Affected versions Fixed in
ThirstyAffiliates 3.12 earliest → < 3.12.1 3.12.1

Other CVEs of ThirstyAffiliates

The 3 CVEs of ThirstyAffiliates →
CVE-2022-0634 The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image… Not rated CVE-2021-24127 Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions… Not rated
Track this CVE