CVE-2026-19801

Name of the Vulnerable Software and Affected Versions BetterLinks versions prior to 3.1.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can create arbitrary short URLs with controlled slugs and redirect destinations, which can be used for phishing and SEO abuse. This issue requires the Fluent Boards companion plugin to be installed and active to ensure the FLUENT BOARDS constant is defined. The exploitation is further enabled by the betterlinks admin nonce nonce being exposed on every frontend page via wp localize script, making it available to any authenticated user.

Recommendations Update BetterLinks to a version newer than 3.1.0.