CVE-2026-108481

HighCVSS 7.4

Published: 12/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in the Patreon WordPress plugin (patreon-connect) up to version 1.10.0. It allows an attacker to force an authenticated user to perform unwanted actions in the context of their session.

Risk Assessment

The risk includes unauthorized actions on a user's account, such as changing settings, potentially leading to data integrity issues or account takeover.

Recommendation

Update the Patreon WordPress plugin to the latest version that includes security fixes and implement CSRF protections (e.g., tokens) in forms.

Other vulnerabilities in Patreon WordPress

CVE-2026-108479High
A Cross-Site Request Forgery (CSRF) vulnerability in the Patreon WordPress plugin (patreon-connect) up to version 1.9.17. It allows an attacker to force an authenticated user to perform unwanted actions in the context of their session.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS