ThirstyAffiliates EUVD-2026-103260

Requires the target site to run ThirstyAffiliates before version 3.12.1 and to have the plugin's link redirect tracking (redirect/click-tracking) handler reachable, which is the plugin's core default function. The information-disclosure path is only meaningful when the site contains affiliate link objects in non-published states (draft, pending, or private) whose destination URLs are not yet public; sites with only published links expose nothing new via this path. No authentication, no user interaction, and no non-default configuration is needed to reach the vulnerable handler (PR:N/UI:N); the principal limiting factor is the low value of the exposed data (affiliate destination URLs) and the integrity effect being confined to click-statistics manipulation rather than site compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 MEDIUM) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, which maximizes reachability, but impact is capped at Low confidentiality and Low integrity with no availability effect. The confidentiality impact is limited to disclosing destination URLs of unpublished (draft/private) affiliate links, and the integrity impact is limited to injecting fabricated click statistics - neither yields code execution, data takeover, nor access to underlying system or user secrets, so this is a genuine but low-consequence information-disclosure/data-integrity issue rather than a critical priority. No EPSS score, SSVC decision data, or POC indicator was provided in the input, and KEV status is not listed (treated as not present); the only exploitation-related signals are a vendor patch and a WPScan advisory. There is no conflict between the CVSS vector and the description - both agree on unauthenticated network access. The main uncertainty is quantitative exploitation likelihood: EPSS and SSVC are MISSING, so prioritization should rest on the low technical impact, meaning this is best patched in routine maintenance cycles rather than as an emergency.

An unauthenticated attacker sends crafted requests to the ThirstyAffiliates link redirect tracking handler referencing link objects that are unpublished (draft, pending, or private), and the handler returns or redirects to the hidden destination URL without checking object status or type, leaking affiliate destinations not yet meant to be public. The same handler can be hit repeatedly to record fabricated click counts, polluting the site owner's affiliate analytics. No public exploit code was identified in the provided data.