CVE-2026-19801: CWE-862 Missing Authorization in wpdevteam BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
The BetterLinks WordPress plugin up to version 3.1.0 has an authorization bypass vulnerability that allows authenticated users with subscriber-level access or higher to create arbitrary short URLs with attacker-controlled slugs and redirect destinations. Exploitation requires the Fluent Boards companion plugin to be active, and the vulnerability is facilitated by a nonce exposed on every frontend page. This can enable phishing and SEO abuse. The vulnerability has a medium severity score of 4.3 and no confirmed patch or official remediation is currently documented.
AI Analysis
Technical Summary
CVE-2026-19801 is an authorization bypass vulnerability (CWE-862) in the BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP WordPress plugin. Versions up to and including 3.1.0 do not properly verify user authorization for certain actions, allowing authenticated users with subscriber-level privileges or higher to create arbitrary short URLs with attacker-controlled slugs and redirect targets. Exploitation requires the Fluent Boards plugin to be installed and active, which defines the FLUENT_BOARDS constant. Additionally, the betterlinks_admin_nonce is exposed on all frontend pages via wp_localize_script, making it accessible to any authenticated user. This vulnerability can be abused for phishing and SEO manipulation. No patch or official fix has been confirmed as of the published date.
Potential Impact
Authenticated users with subscriber-level access or higher can bypass authorization controls to create arbitrary short URLs in the BetterLinks plugin. This can be leveraged to craft malicious redirects facilitating phishing attacks and SEO abuse. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing unauthorized creation of redirect links.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the BetterLinks plugin or the Fluent Boards companion plugin if not required, and restrict authenticated user roles to minimize exposure. Monitor vendor channels for updates.
CVE-2026-19801: CWE-862 Missing Authorization in wpdevteam BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
Description
The BetterLinks WordPress plugin up to version 3.1.0 has an authorization bypass vulnerability that allows authenticated users with subscriber-level access or higher to create arbitrary short URLs with attacker-controlled slugs and redirect destinations. Exploitation requires the Fluent Boards companion plugin to be active, and the vulnerability is facilitated by a nonce exposed on every frontend page. This can enable phishing and SEO abuse. The vulnerability has a medium severity score of 4.3 and no confirmed patch or official remediation is currently documented.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19801 is an authorization bypass vulnerability (CWE-862) in the BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP WordPress plugin. Versions up to and including 3.1.0 do not properly verify user authorization for certain actions, allowing authenticated users with subscriber-level privileges or higher to create arbitrary short URLs with attacker-controlled slugs and redirect targets. Exploitation requires the Fluent Boards plugin to be installed and active, which defines the FLUENT_BOARDS constant. Additionally, the betterlinks_admin_nonce is exposed on all frontend pages via wp_localize_script, making it accessible to any authenticated user. This vulnerability can be abused for phishing and SEO manipulation. No patch or official fix has been confirmed as of the published date.
Potential Impact
Authenticated users with subscriber-level access or higher can bypass authorization controls to create arbitrary short URLs in the BetterLinks plugin. This can be leveraged to craft malicious redirects facilitating phishing attacks and SEO abuse. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing unauthorized creation of redirect links.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the BetterLinks plugin or the Fluent Boards companion plugin if not required, and restrict authenticated user roles to minimize exposure. Monitor vendor channels for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-13T20:26:16.903Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8cf578acd9273b49842846
Added to database: 08/25/2026, 01:52:56 UTC
Last enriched: 08/25/2026, 02:22:39 UTC
Last updated: 08/25/2026, 02:52:00 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.