[ CVE-2026-97314 · Published 17 Oct 2026 ]
Vulnerability in Unknown ThirstyAffiliates
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.