Severe Bug: URLs broken, tracking does not work!

We just discovered a severe bug in your great plugin:
statistics Link-tracking does not work, Links lead to nirvana!

An URL specified within text in the drag and drop composer referring to itself is being parsed and rewriten as ../ ( http://my-domain.com/postname/ becomes ../postname/ )

This truncated URL is then used for click-tracking being base64_encoded as e.g.

http://dana-arzani.de/?nltr=MjI7MTsuLi9mdWVyLWtpbmRlci16dS10ZXVlci87OzNiYjJmMTc5ZGQzN2RkMGQwOWMwODA1MmQ1Nzk5MmMw

However, verification of this truncated URL fails in statistics.php when the nltr string is being decoded again and checked for being from the originating host itself:

$verified = $parts[‘host’] == $_SERVER[‘HTTP_HOST’];

Since this fails, clicking a link within the newsletter leads to a white error page with just the note “Url not verified” (triggered by statistics.php at line 57)

As a workaround, we tried to disable tracking. This results in the URL not being provided within the newsletter at all.

I cross checked on different servers and was able to reproduce this behaviour.

Affected Version: 4.7.3, WordPress 4.7 (System is up to date)

The solution is to stop the provided domain-part being rewritten to ../

Too bad we noticed this bug just after the Newsletter was sent. Would be great if you could provide an update asap. Alternativelly, you can point me to where the URL is being rewritten, so I can apply an interim fix until you provide an update.

Thank you and Kind Regards,

dk