CVE-2026-97314

Status: DeferredMedium (6.5)—

Severity6.5Medium · CVSS 3.1

Exploitation probability0.18 %higher than 7% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

CVSS

Base score: 6.5
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.18 %
Percentile among all scored CVEs: 7
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access92 %
Primary impactT1005 Data from Local Systemcollection70 %
Secondary impactT1565.001 Stored Data Manipulationimpact55 %

Vector AV:N/PR:N/UI:N y el texto indica que un atacante no autenticado obtiene las URLs de destino de enlaces no publicados (lectura) y registra estadísticas de clics falsas (manipulación de datos).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation Limit Access to Resource Over Network

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Thirstyaffiliates — Thirstyaffiliates^AI

CWEs

CWE-200

References

Show 1 references

https://wpscan.com/vulnerability/37e0a31e-39cc-4035-ae27-b34e7ec8f0d0/

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-97314",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-97314",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-18T10:59:04.652899Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "ThirstyAffiliates",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.12.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-17T06:16:34.553",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/37e0a31e-39cc-4035-ae27-b34e7ec8f0d0/",
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics."
    }
  ],
  "lastModified": "2026-10-19T21:04:50.950",
  "sourceIdentifier": "contact@wpscan.com"
}