What the vulnerability does
01Description
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.
Explanation of Vulnerability in Simple Terms
02Summary
BetterLinks versions 3.1.0 and earlier lack proper authorization checks, allowing authenticated users to modify link data they should not have access to. An attacker with a low-privilege account can alter redirect targets, cloaking settings, or affiliate link configurations. This affects the integrity of shortened links and could be used to redirect users to malicious sites or hijack affiliate commissions.
What an attacker can do
03Attacker Capabilities
Modify or redirect links belonging to other users or the site.
Potential impact on your site
04Site Impact
Links can be hijacked or redirected to malicious destinations; affiliate commissions may be stolen.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WordPress site.
Key dates
06Disclosure timeline
August 25, 2026
CVE published
