CVE-2026-97314
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the…
- Risk score
- 40/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 17 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
- Affected
- See advisory
- Fix
- Upgrade the product to 3.12.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
Last activity 17 Oct 2026. Patch Forecast updates every hour.