CVE-2026-92433
UnknownSummary
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Risk Assessment
An attacker can take over the site's Patreon integration, redirecting payments and content to their own account, potentially resulting in loss of revenue and control over the integration.
Recommendation
Update the Patreon plugin to version 1.10.0 or later.
Other vulnerabilities in Patreon WordPress plugin
See all- CVE-2026-92432Unknown
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
- CVE-2026-92431Unknown
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Original NVD description (English source)
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS