CVE-2026-19801: BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENTBOARDS constant is defined), and is further facilitated by the betterlinksadminnonce nonce being emitted on every frontend page via wplocalizescript, making it accessible to any authenticated user.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
Installations running BetterLinks 3.1.0 or earlier are exposed only when the Fluent Boards companion plugin is installed and active, causing the FLUENT_BOARDS constant to be defined.
What access does an attacker need?
An attacker needs an authenticated WordPress account with subscriber-level privileges or higher. No user interaction is required.
Does exploitation require access to the WordPress admin interface?
The nonce needed for the create_fbs_link AJAX action is emitted on every frontend page through wp_localize_script. Any authenticated user can therefore obtain it from frontend pages.
What could a successful attacker do?
They can create BetterLinks short URLs with attacker-controlled slugs and redirect destinations. This can be used for phishing or SEO abuse.