The BetterLinks WordPress plugin contains an authorization bypass that allows any authenticated user with a subscriber role or higher to create arbitrary short URLs with attacker‑controlled slugs and redirect destinations. The flaw originates in the create_fbs_link AJAX action, which fails to verify that the requester is authorized to perform the link creation. This weakness can be abused to launch phishing campaigns or manipulate search engine rankings, and it is classified as CWE‑862.

WordPress sites using the BetterLinks plugin version 3.1.0 or earlier and having the Fluent Boards companion plugin active are affected, because the FLUENT_BOARDS constant is required for the vulnerability to be reachable. The issue exists in all releases up to and including 3.1.0.

The CVSS score of 4.3 indicates a medium severity risk. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with at least subscriber privileges; the betterlinks_admin_nonce nonce is delivered on every frontend page via wp_localize_script, enabling the attacker to obtain a valid nonce without additional effort. Once the nonce is available, the attacker can craft an AJAX request to create_fbs_link and create a malicious short link. Although the requirement for the Fluent Boards plugin limits the threat surface, the lack of widespread public exploits suggests that, while feasible, the real‑world risk is moderate.