---
id: "CVE-2026-97314"
kind: "vulnerability"
aliases: ["CVE-2026-97314"]
title: "ThirstyAffiliates WordPress plugin leaks unpublished affiliate link destinations"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["affiliate-marketing", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-10-17T06:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97314", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# ThirstyAffiliates WordPress plugin leaks unpublished affiliate link destinations

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check whether the affiliate link it is asked to redirect to is published or of the right type. An unauthenticated visitor can read the destination URLs of unpublished links and inflate click statistics with fake clicks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ThirstyAffiliates version in the WordPress admin plugins list or with `wp plugin get thirstyaffiliates --field=version`
- Confirm whether the plugin is active on the site

## Fix

- Update the ThirstyAffiliates plugin to `3.12.1` or later

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97314

## From the sources

The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_