Authorization Bypass Vulnerability in BetterLinks Plugin for WordPress

CVE-2026-19801

What is CVE-2026-19801?

The BetterLinks plugin for WordPress contains a serious authorization bypass vulnerability that affects all versions up to and including 3.1.0. The flaw arises from the plugin's failure to adequately verify user authorization, allowing authenticated users with subscriber-level access and above to create malicious BetterLinks short URLs. These compromised URLs can include user-controlled slugs and redirect destinations, which may be exploited for phishing attacks and SEO manipulation. Successful exploitation of this vulnerability requires the installation and activation of the Fluent Boards companion plugin, as it defines the FLUENT_BOARDS constant. Furthermore, the vulnerability is exacerbated by the improper exposure of the betterlinks_admin_nonce nonce on every frontend page through wp_localize_script, rendering it accessible to any authenticated user.

References