{
 "id": "WPSEC-2026-1038",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1038/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1038/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1038/index.md",
 "title": "ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Unauthenticated Information Exposure of Unpublished Affiliate Links via 'ta_click_data_redirect' and 'ta_link_fixer' AJAX Actions",
 "description": "The ThirstyAffiliates plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'ta_click_data_redirect' and 'ta_link_fixer' AJAX actions in all versions up to, and including, 3.12.0. This is due to the public link lookups not restricting results to published affiliate links. This makes it possible for unauthenticated attackers to get data from draft, pending, private or trashed affiliate links, such as the destination URL (when the JavaScript redirect option is on or the link is uncloaked), the link name and the link ID, and to record click statistics for those links.",
 "plugin": {
  "slug": "thirstyaffiliates",
  "name": "ThirstyAffiliates Affiliate Link Manager",
  "full_name": "ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin",
  "wordpress_org": "https://wordpress.org/plugins/thirstyaffiliates/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thirstyaffiliates/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thirstyaffiliates"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.12.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.12.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.12.1",
 "remediation": "Update to 3.12.1 or later.",
 "fix_released": "2026-10-14T17:17:31+00:00",
 "published": "2026-10-15T17:57:41+00:00",
 "updated": "2026-10-15T08:15:37.975094+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1038/",
  "https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/",
  "https://wordpress.org/plugins/thirstyaffiliates/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thirstyaffiliates",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-15"
 }
}