{
 "id": "WPSEC-2026-1037",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1037/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1037/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1037/index.md",
 "title": "ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Missing Authorization to Authenticated (Contributor+) Stripe API Key Exposure via Payments Settings Tab",
 "description": "The ThirstyAffiliates plugin for WordPress is vulnerable to unauthorized access of sensitive data via the Payments (ThirstyPay) settings tab in all versions from 3.11.0 up to, and including, 3.12.0. This is due to a missing capability check: the settings page is registered with the 'read' capability for any user who can edit posts, the plugin's tab access check skips tabs that are not in its capability map, and the 'ta_thirstypay_settings' tab is not in that map. This makes it possible for authenticated attackers with Contributor-level access and above to view the Payments settings page, which outputs the site's stored Stripe live and test secret and publishable API keys in form fields.",
 "plugin": {
  "slug": "thirstyaffiliates",
  "name": "ThirstyAffiliates Affiliate Link Manager",
  "full_name": "ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin",
  "wordpress_org": "https://wordpress.org/plugins/thirstyaffiliates/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thirstyaffiliates/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thirstyaffiliates"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.11.0",
    "from_inclusive": true,
    "to": "3.12.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.11.0 before 3.12.1"
  ]
 },
 "introduced_in": "3.11.0",
 "fixed_in": "3.12.1",
 "remediation": "Update to 3.12.1 or later.",
 "fix_released": "2026-10-14T17:17:31+00:00",
 "published": "2026-10-15T17:57:41+00:00",
 "updated": "2026-10-15T08:15:37.975094+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1037/",
  "https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/",
  "https://wordpress.org/plugins/thirstyaffiliates/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thirstyaffiliates",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-15"
 }
}