CVE-2026-92431
UnknownSummary
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Risk Assessment
An attacker can discover the names of hidden taxonomies and terms, potentially revealing information about the site structure and facilitating further attacks.
Recommendation
Update the Patreon plugin to version 1.10.0 or later.
Other vulnerabilities in Patreon WordPress plugin
See all- CVE-2026-92433Unknown
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
- CVE-2026-92432Unknown
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
Original NVD description (English source)
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS