CVE-2026-92432
UnknownSummary
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
Risk Assessment
An attacker can use the site to redirect users to malicious phishing pages, exposing their credentials and undermining trust in the site.
Recommendation
Update the Patreon plugin to version 1.10.0 or later.
Other vulnerabilities in Patreon WordPress plugin
See all- CVE-2026-92433Unknown
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
- CVE-2026-92431Unknown
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Original NVD description (English source)
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS