{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:32:47.984379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:22:38.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP",
          "vendor": "wpdevteam",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T01:26:44.025Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L180"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L180"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/betterlinks.php#L254"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/betterlinks.php#L254"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658390%40betterlinks\u0026new=3658390%40betterlinks"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-13T20:41:23.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T13:23:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "BetterLinks \u003c= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19801",
    "datePublished": "2026-08-25T01:26:44.025Z",
    "dateReserved": "2026-08-13T20:26:16.903Z",
    "dateUpdated": "2026-08-25T19:22:38.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19801\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T18:32:47.984379Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T18:32:49.533Z\"}}], \"cna\": {\"title\": \"BetterLinks \u003c= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Wordfence PRISM\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"wpdevteam\", \"product\": \"BetterLinks \\u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.1.0\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-13T20:41:23.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-08-24T13:23:38.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L180\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L180\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/includes/Admin/Ajax.php#L99\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.1.0/betterlinks.php#L254\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/includes/Admin/Ajax.php#L99\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/betterlinks/tags/3.0.0/betterlinks.php#L254\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658390%40betterlinks\u0026new=3658390%40betterlinks\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The BetterLinks \\u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager \u0026 MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-08-25T01:26:44.025Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-19801\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:22:38.068Z\", \"dateReserved\": \"2026-08-13T20:26:16.903Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-08-25T01:26:44.025Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}