The ThirstyAffiliates WordPress plugin before version 3.12.1 allows an unauthenticated attacker to use its link redirect tracking handler without proper validation of the requested object’s status or type. This flaw enables the attacker to reveal the destination URLs of unpublished affiliate links and to inject fabricated click statistics. As a result, sensitive campaign details can be exposed while also corrupting revenue metrics that rely on click data.

All WordPress sites that have the ThirstyAffiliates plugin installed with a version older than 3.12.1 are affected. No additional version granularities are listed in the CNA data, so any installation of the plugin prior to the 3.12.1 release is vulnerable.

The vulnerability can be exercised by any user who can access the site’s public URLs, as no authentication or authorization checks are enforced on the redirect handler. The CVSS score is 6.5 and the EPSS score is < 1%, indicating a moderate severity with low probability of exploitation, and the flaw is fully exploitable and has the potential to alter affiliate reporting. The lack of a KEV listing suggests that it has not yet been widely leveraged, but the attack path is straightforward, making the risk moderate to high for sites reliant on accurate affiliate tracking.