CVE-2026-19801

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.

• CWE-862

• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/betterlinks.php#L254
• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L180
• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L99
• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/betterlinks.php#L254
• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L180
• https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L99
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3658390%40betterlinks&new=3658390%40betterlinks
• https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=cve

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19794The WP-Stats plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2026-19795Qiskit could allow a local attacker to cause a denial of ser…6.2
• CVE-2026-19796The Listdom: AI-powered Business Directory with Classifieds …7.2
• CVE-2026-19797The User Access Manager plugin for WordPress is vulnerable t…6.1
• CVE-2026-1980The WPBookit plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2026-19800The Mail Mint – Email Marketing, Newsletter, Email Automatio…4.9
• CVE-2026-19802The Checkout Custom Fields Builder for WooCommerce plugin fo…4.3
• CVE-2026-19806The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & C…8.8
• CVE-2026-1981The HUMN-1 AI Website Scanner & Human Certification by Winst…4.3
• CVE-2026-19811A security flaw has been discovered in TOTOLINK A800R 4.1.2c…8.8
• CVE-2026-19812A weakness has been identified in TOTOLINK A800R 4.1.2cu.513…8.8
• CVE-2026-19813A security vulnerability has been detected in TOTOLINK A800R…8.8