Live › vulnerability › CVE-2026-97314
Go to dashboardThe ThirstyAffiliates WordPress plugin before 3.12.1 does not check whether the affiliate link it is asked to redirect to is published or of the right type. An unauthenticated visitor can read the destination URLs of unpublished links and inflate click statistics with fake clicks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ThirstyAffiliates WordPress plugin older than 3.12.1 that use its link redirect tracking. The exposure is the redirect handler, which accepts requests without logging in, so any public site with the plugin active is reachable. Sites that have already updated, or that do not run the plugin, can skip it.
No product ranges from the sources yet.
wp plugin get thirstyaffiliates --field=version3.12.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
This page as .md · .json · in your agent: get_signal("CVE-2026-97314")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.