CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...

CVE-2026-19801

The BetterLinks WordPress plugin (Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP) is vulnerable to authorization bypass in all versions up to and including 3.1.0 . The root cause is improper verification of user authorization in the create_fbs_link AJAX action, allowing an...

CVE-2026-18736

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-18736

Technical details about CVE-2026-18736 are not publicly available in the provided documents. Monitor for updates for affected products, versions, impact specifics, and remediation guidance.

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

PT-2026-67503

Name of the Vulnerable Software and Affected Versions Shlink affected versions not specified Description Authenticated API key holders can trigger server-side request forgery SSRF, a flaw where the server is coerced into making unauthorized requests. By providing a crafted long URL during the sho...