CVE-2026-97314

MediumCVSS 6.5

Published: 17/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

Risk Assessment

Attackers can learn confidential destination URLs of unpublished affiliate links and falsify click statistics, potentially leading to business information leakage and corrupted analytics data.

Recommendation

Update the ThirstyAffiliates plugin to version 3.12.1 or later.

Other vulnerabilities in ThirstyAffiliates WordPress plugin

CVE-2026-119089High
The ThirstyAffiliates plugin for WordPress in versions up to and including 3.12.1 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS