# ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Unauthenticated Information Exposure of Unpublished Affiliate Links via 'ta_click_data_redirect' and 'ta_link_fixer' AJAX Actions

- **ID:** WPSEC-2026-1038
- **Plugin:** ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin (`thirstyaffiliates`), https://wordpress.org/plugins/thirstyaffiliates/
- **Affected versions:** all versions before 3.12.1
- **Fixed in:** 3.12.1 (Update to 3.12.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thirstyaffiliates
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1038/

## Description

The ThirstyAffiliates plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'ta_click_data_redirect' and 'ta_link_fixer' AJAX actions in all versions up to, and including, 3.12.0. This is due to the public link lookups not restricting results to published affiliate links. This makes it possible for unauthenticated attackers to get data from draft, pending, private or trashed affiliate links, such as the destination URL (when the JavaScript redirect option is on or the link is uncloaked), the link name and the link ID, and to record click statistics for those links.

## References

- https://wpsec.com/vuln/WPSEC-2026-1038/
- https://plugins.svn.wordpress.org/thirstyaffiliates/tags/3.12.1/
- https://wordpress.org/plugins/thirstyaffiliates/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1038/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.