{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP",
          "vendor": "wpdevteam",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user."
    },
    {
      "lang": "es",
      "value": "El plugin BetterLinks - Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 3.1.0, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, creen URLs cortas arbitrarias de BetterLinks con slugs controlados por el atacante y destinos de redirecci\u00f3n, lo que permite el phishing y el abuso de SEO. La explotaci\u00f3n requiere que el plugin complementario Fluent Boards est\u00e9 instalado y activo (para que la constante FLUENT_BOARDS est\u00e9 definida), y se facilita a\u00fan m\u00e1s por el nonce betterlinks_admin_nonce siendo emitido en cada p\u00e1gina de frontend a trav\u00e9s de wp_localize_script, haci\u00e9ndolo accesible a cualquier usuario autenticado."
    }
  ],
  "id": "CVE-2026-19801",
  "lastModified": "2026-10-12T15:10:00.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19801",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T18:32:47.984379Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T02:16:40.250",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/betterlinks.php#L254"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L180"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L99"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/betterlinks.php#L254"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L180"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L99"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658390%40betterlinks\u0026new=3658390%40betterlinks"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}