CVE-2026-97314— ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
Quick assessment
Affected
Unknown ThirstyAffiliates
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ThirstyAffiliates WordPress 插件在 3.12.1 版本之前，其链接重定向跟踪处理程序未对请求对象的类型或状态进行验证，这使得未认证的攻击者能够泄露未发布联盟链接的目标 URL，并伪造点击统计数据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97314
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | ThirstyAffiliates | 0 ~ 3.12.1 | - |
|
II. Public POCs for CVE-2026-97314
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97314
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-17 · 12 CVEs total
| CVE-2026-110527 | WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Pa | |
| CVE-2026-81344 | Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection | |
| CVE-2026-81343 | Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update vi | |
| CVE-2026-106470 | WP Data Access < 5.5.88 - Subscriber+ SSRF | |
| CVE-2026-103376 | PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay | |
| CVE-2026-92433 | Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF | |
| CVE-2026-92432 | Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter | |
| CVE-2026-92431 | Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration | |
| CVE-2026-104122 | Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name | |
| CVE-2026-104246 | Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Tra | |
| CVE-2026-91074 | BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute |
IV. Related Vulnerabilities
Same product: ThirstyAffiliates
Same vendor: Unknown
-
CVE-2026-110527
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creat -
CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object -
CVE-2026-81343
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated AC -
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF -
CVE-2026-103376
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disc
V. Comments for CVE-2026-97314
No comments yet