---
id: CVE-2026-97314
title: >-
  ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link
  Destination Disclosure and Click Statistic Injection
summary: >-
  The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the
  status or type of the object requested by its link redirect tracking handler,
  allowing unauthenticated attackers to disclose the destination URLs of
  unpublished aff…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: ThirstyAffiliates
affected:
  - ThirstyAffiliates < 3.12.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-18T10:59:04.652899Z'
published: '2026-10-17'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T11:12:31.635Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97314'
references:
  - url: 'https://wpscan.com/vulnerability/37e0a31e-39cc-4035-ae27-b34e7ec8f0d0/'
tags:
  - cve.org
ingestedAt: '2026-10-17T07:01:26.049Z'
epss: 0.00179
epssPercentile: 0.07434
---

## Overview

The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

## Affected

- `ThirstyAffiliates < 3.12.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.