# ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Missing Authorization to Authenticated (Contributor+) Stripe API Key Exposure via Payments Settings Tab

- **ID:** WPSEC-2026-1037
- **Plugin:** ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin (`thirstyaffiliates`), https://wordpress.org/plugins/thirstyaffiliates/
- **Affected versions:** from 3.11.0 before 3.12.1
- **Fixed in:** 3.12.1 (Update to 3.12.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thirstyaffiliates
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1037/

## Description

The ThirstyAffiliates plugin for WordPress is vulnerable to unauthorized access of sensitive data via the Payments (ThirstyPay) settings tab in all versions from 3.11.0 up to, and including, 3.12.0. This is due to a missing capability check: the settings page is registered with the 'read' capability for any user who can edit posts, the plugin's tab access check skips tabs that are not in its capability map, and the 'ta_thirstypay_settings' tab is not in that map. This makes it possible for authenticated attackers with Contributor-level access and above to view the Payments settings page, which outputs the site's stored Stripe live and test secret and publishable API keys in form fields.

## References

- https://wpsec.com/vuln/WPSEC-2026-1037/
- https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/
- https://wordpress.org/plugins/thirstyaffiliates/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1037/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.