{"id":"CVE-2026-19801","aliases":["EUVD-2026-65193","GHSA-64w4-qrww-rxhv"],"status":"published","title":"BetterLinks \u003c= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action","description":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00403,"percentile":0.34903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-25T01:26:44Z","modified":"2026-10-12T15:10:00Z","products":[{"vendor":"wpdevteam","product":"betterlinks – link shortener, link cloaking, redirects, affiliate link manager \u0026 mcp"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L180"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L180"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L99"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/betterlinks.php#L254"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L99"},{"url":"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/betterlinks.php#L254"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658390%40betterlinks\u0026new=3658390%40betterlinks"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19801"},{"url":"https://github.com/advisories/GHSA-64w4-qrww-rxhv"}],"sources":{"cve":[{"id":"CVE-2026-19801","title":"BetterLinks \u003c= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action","description":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.","status":"published","published":"2026-08-25T01:26:44.025Z","modified":"2026-08-25T19:22:38.068Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-65193","description":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.","status":"published","published":"2026-08-25T01:26:44Z","modified":"2026-08-25T19:22:38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.174502Z"}],"ghsa":[{"id":"GHSA-64w4-qrww-rxhv","title":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin...","description":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.","status":"published","published":"2026-08-25T03:32:08Z","modified":"2026-08-25T03:32:14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:10:55.456762Z"}],"nvd":[{"id":"CVE-2026-19801","description":"The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.","status":"published","published":"2026-08-25T02:16:40.25Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:41.018848Z"}]}}