CVE Intelligence
Skip to main content
MEDIUM

CVE-2026-19801

CVE-2026-19801 — BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.

Published Updated Sources: cvelistV5, Wordfence

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

0%

chance of exploitation in 30 days

Affects

wpdevteam

betterlinks_link_shortener_link_cloaking_redirects_affiliate_link_manager_mcp

CVSS base

4.3

MEDIUM

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

wpdevteam

Products (1)

betterlinks link shortener link cloaking redirects affiliate link manager mcp

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
4.3CVSS 3.1MEDIUM——cvelistV5

Weakness & attack patterns

  • CWE-862

Attack patterns reported against this CVE. The ATT&CK techniques below are inferred from its weakness class.

  • T1211Exploitation for Defensive Evasion
  • T1542.002Pre-OS Boot: Component Firmware
  • T1556Modify Authentication Process

References

8 on the record

Elsewhere on this site

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.