CVE-2026-19801: CWE-862 Missing Authorization in wpdevteam BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP

CVE-2026-19801 is an authorization bypass vulnerability (CWE-862) in the BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP WordPress plugin versions up to and including 3.1.0. The plugin fails to properly verify user authorization for certain actions, allowing authenticated users with subscriber-level privileges or higher to create arbitrary short URLs with attacker-controlled slugs and redirect targets. Exploitation requires the Fluent Boards companion plugin to be installed and active, which defines the FLUENT_BOARDS constant and causes the betterlinks_admin_nonce nonce to be emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user. This flaw enables phishing and SEO abuse by manipulating redirect URLs.

Authenticated users with subscriber-level access or higher can bypass authorization controls to create arbitrary short URLs with attacker-controlled redirect destinations. This can facilitate phishing attacks and SEO abuse by redirecting users to malicious sites. There is no direct confidentiality or availability impact reported. Exploitation requires the Fluent Boards plugin to be active.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict installation or activation of the Fluent Boards plugin if not needed, and limit user roles to trusted users only. Monitor for plugin updates from wpdevteam addressing this issue.