Patreon Plugin CSRF Vulnerability Before 1.10.0

Executive Summary

CVE-2026-92433 is a Cross-Site Request Forgery (CSRF) vulnerability in the Patreon WordPress plugin versions before 1.10.0. It allows attackers to trick a logged-in administrator into re-linking the site's Patreon integration to an attacker-controlled account via a crafted request. The plugin fails to verify a nonce during the connection process, enabling unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Patreon WordPress plugin. If it is below 1.10.0, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to take over the site's Patreon integration. If exploited, an attacker could gain control over how the site interacts with Patreon, potentially redirecting funds, altering content, or disrupting services tied to the integration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to user data through the compromised Patreon integration. If an attacker takes over the integration, they may gain access to user data processed via the plugin, which could violate data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

• Update the Patreon WordPress plugin to version 1.10.0 or later immediately.
• Review and remove any unauthorized Patreon integrations linked to the site.
• Monitor for suspicious administrator actions or unauthorized changes to the plugin settings.

Useful 0 Not Useful 0