CVE-2026-97314

The ThirstyAffiliates WordPress plugin, in versions prior to 3.12.1 , contains a vulnerability where the link redirect tracking handler fails to verify the status or type of requested objects. This flaw allows unauthenticated attackers to discover the destination URLs of unpublished affiliate lin...

CVE-2026-97314 ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...