ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Missing Authorization to Authenticated (Contributor+) Stripe API Key Exposure via Payments Settings Tab
- ID
- WPSEC-2026-1037
- Plugin
- ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin (thirstyaffiliates)
- Affected
- from 3.11.0 before 3.12.1
- Remediation
- Update to 3.12.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- ThirstyAffiliates Affiliate Link Manager on WPSec AttackSurface
- Fix released
- Published
Description
The ThirstyAffiliates plugin for WordPress is vulnerable to unauthorized access of sensitive data via the Payments (ThirstyPay) settings tab in all versions from 3.11.0 up to, and including, 3.12.0. This is due to a missing capability check: the settings page is registered with the 'read' capability for any user who can edit posts, the plugin's tab access check skips tabs that are not in its capability map, and the 'ta_thirstypay_settings' tab is not in that map. This makes it possible for authenticated attackers with Contributor-level access and above to view the Payments settings page, which outputs the site's stored Stripe live and test secret and publishable API keys in form fields.
References
- https://wpsec.com/vuln/WPSEC-2026-1037/
- https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/
- https://wordpress.org/plugins/thirstyaffiliates/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS