---
id: CVE-2026-97314
title: >-
  ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link
  Destination Disclosure and Click Statistic Injection
summary: >-
  The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the
  status or type of the object requested by its link redirect tracking handler,
  allowing unauthenticated attackers to disclose the destination URLs of
  unpublished aff…
severity: none
cwe:
  - CWE-200
product: ThirstyAffiliates
affected:
  - ThirstyAffiliates < 3.12.1
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T06:00:15.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97314'
references:
  - url: 'https://wpscan.com/vulnerability/37e0a31e-39cc-4035-ae27-b34e7ec8f0d0/'
tags:
  - cve.org
ingestedAt: '2026-10-17T07:01:26.049Z'
---

## Overview

The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

## Affected

- `ThirstyAffiliates < 3.12.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.