Unauthenticated Taxonomy Term Enumeration in Patreon WordPress Plugin

Executive Summary

The Patreon WordPress plugin before version 1.10.0 has a flaw where it does not check if users are authorized to access certain features. This allows anyone, even without logging in, to list the names of terms in any taxonomy, including hidden or non-public taxonomies that WordPress typically does not display.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Patreon WordPress plugin version is 1.10.0 or lower. You can use WPScan with the command: wpscan --url <target_url> --enumerate vp,vt. Alternatively, inspect the plugin files for missing authorization checks in taxonomy-related functions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to gather information about your site's structure, such as private taxonomies or terms, which might help them plan further attacks. It exposes internal details that should not be publicly accessible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated users to enumerate taxonomy terms, including non-public ones, which could expose sensitive data. This may violate GDPR's data protection principles if personal data is exposed, and HIPAA's security rules if protected health information is involved.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Patreon WordPress plugin to version 1.10.0 or higher. If updating is not possible, consider disabling the plugin until an update is applied. Regularly audit plugins for similar issues and ensure proper access controls are enforced.

Useful 0 Not Useful 0