BetterLinks <= 3.1.3 - Incorrect Authorization to Click Analytics Deletion
- ID
- WPSEC-2026-0299
- Plugin
- BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP (betterlinks)
- Affected
- from 1.5.11 before 3.1.4
- Remediation
- Update to 3.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- BetterLinks on WPSec AttackSurface
- Fix released
- Published
Description
The BetterLinks plugin for WordPress is vulnerable to unauthorized data deletion in versions 1.5.11 up to, and including, 3.1.3. The reset_analytics AJAX action, which deletes click records, was gated by the analytics view permission filter (betterlinks/api/analytics_items_permissions_check) instead of a delete permission. This makes it possible for authenticated users whose role has been granted only analytics viewing, for example through BetterLinks Pro's Role Management 'Who Can Check Analytics' setting, to delete all or selected click analytics. Sites that have not delegated analytics access are not affected, as the check defaults to administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-0299/
- https://plugins.svn.wordpress.org/betterlinks/tags/3.1.4/
- https://wordpress.org/plugins/betterlinks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS