CVE-2026-97314
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
| Vendor | unknown |
| Product | thirstyaffiliates |
| Published | Oct 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown thirstyaffiliates
Be the first to know when new unknown vulnerabilities affecting unknown thirstyaffiliates are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ThirstyAffiliates
0 < 3.12.1
References
Credits
Usama Arshad WPScan