Vulnerabilities / ThirstyAffiliates Affiliate Link Manager / WPSEC-2026-1038
ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Unauthenticated Information Exposure of Unpublished Affiliate Links via 'ta_click_data_redirect' and 'ta_link_fixer' AJAX Actions
Medium 6.5
CWE-200Fixed in 3.12.1
- ID
- WPSEC-2026-1038
- Plugin
- ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin (thirstyaffiliates)
- Affected
- all versions before 3.12.1
- Remediation
- Update to 3.12.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- ThirstyAffiliates Affiliate Link Manager on WPSec AttackSurface
- Fix released
- Published
Description
The ThirstyAffiliates plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'ta_click_data_redirect' and 'ta_link_fixer' AJAX actions in all versions up to, and including, 3.12.0. This is due to the public link lookups not restricting results to published affiliate links. This makes it possible for unauthenticated attackers to get data from draft, pending, private or trashed affiliate links, such as the destination URL (when the JavaScript redirect option is on or the link is uncloaked), the link name and the link ID, and to record click statistics for those links.
References
- https://wpsec.com/vuln/WPSEC-2026-1038/
- https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/
- https://wordpress.org/plugins/thirstyaffiliates/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS