{"id":"CVE-2026-97314","kind":"vulnerability","aliases":["CVE-2026-97314"],"related":[],"title":"ThirstyAffiliates WordPress plugin leaks unpublished affiliate link destinations","description":"The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.","summary":"The ThirstyAffiliates WordPress plugin before 3.12.1 does not check whether the affiliate link it is asked to redirect to is published or of the right type. An unauthenticated visitor can read the destination URLs of unpublished links and inflate click statistics with fake clicks.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["affiliate-marketing","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed ThirstyAffiliates version in the WordPress admin plugins list or with `wp plugin get thirstyaffiliates --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update the ThirstyAffiliates plugin to `3.12.1` or later","status":"open","published_at":"2026-10-17T06:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:37+00:00","updated_at":"2026-10-25T03:57:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:57:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ThirstyAffiliates plugin to `3.12.1` or later","reach":"internet","title":"ThirstyAffiliates WordPress plugin leaks unpublished affiliate link destinations","impact":"low","summary":"The ThirstyAffiliates WordPress plugin before 3.12.1 does not check whether the affiliate link it is asked to redirect to is published or of the right type. An unauthenticated visitor can read the destination URLs of unpublished links and inflate click statistics with fake clicks.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","affiliate-marketing"],"confidence":0.8,"needs_auth":"no","worst_case":"Unpublished affiliate destination URLs readable and click statistics falsified by anyone","analyst_note":"","how_to_check":"- Check the installed ThirstyAffiliates version in the WordPress admin plugins list or with `wp plugin get thirstyaffiliates --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":false,"not_affected_if":["plugin-updated","plugin-not-installed"],"who_is_affected":"Sites running the ThirstyAffiliates WordPress plugin older than 3.12.1 that use its link redirect tracking. The exposure is the redirect handler, which accepts requests without logging in, so any public site with the plugin active is reachable. Sites that have already updated, or that do not run the plugin, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3315,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-97314':11A,14A '3.12.1':28B,72C 'affili':6A,16B,34B,100C 'affiliate-market':15B 'allow':90C 'ask':38B 'attack':92C 'check':31B,75C 'click':62B,66B,106C 'cve':9A,12A 'destin':8A,55B,96C 'disclos':94C 'fabric':105C 'fake':65B 'handler':89C 'inflat':61B 'leak':4A 'link':7A,35B,59B,86C,101C 'market':17B 'object':82C 'packag':18B 'plugin':3A,22B,26B,70C 'publish':43B 'read':53B 'record':104C 'redirect':40B,87C 'request':83C 'right':47B 'statist':63B,107C 'status':77C 'thirstyaffili':1A,24B,68C 'track':88C 'type':48B,79C 'unauthent':50B,91C 'unpublish':5A,58B,99C 'url':56B,97C 'visitor':51B 'whether':32B 'wordpress':2A,19B,21B,25B,69C 'wordpress-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the ThirstyAffiliates WordPress plugin older than 3.12.1 that use its link redirect tracking. The exposure is the redirect handler, which accepts requests without logging in, so any public site with the plugin active is reachable. Sites that have already updated, or that do not run the plugin, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T06:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97314","severity":null,"published_at":"2026-10-17T06:16:34+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}