PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108479 Patreon CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Patreon WordPress plugin versions up to 1.9.17. This issue allows attackers to perform actions on behalf of users without their consent. Defenders should assess exposure, prioritize remediation, and verify user interactions. The vulnerability impacts WordPress installations with the Patreon plugin, potentially allowing unauthorized actions. Defenders must verify user interactions to prevent unauthorized actions and assess exposure to this CSRF vulnerability.

Vendor
Patreon
Product
Patreon WordPress
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for WordPress installations with the Patreon plugin should assess exposure and prioritize remediation. They must verify user interactions to prevent unauthorized actions and review compensating controls for exposed systems. Security teams and vulnerability management teams should focus on remediation and verifying user interactions.

Why it matters

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Patreon WordPress plugin versions up to 1.9.17. This issue allows attackers to perform actions on behalf of users without their consent. Defenders should assess exposure, prioritize remediation, and verify user interactions.

  • Verify user interactions to prevent unauthorized actions
  • Assess exposure to this CSRF vulnerability in the Patreon WordPress plugin
  • Prioritize remediation of the Patreon WordPress plugin to version 1.10.0 or later

Technical summary

The Patreon WordPress plugin versions up to 1.9.17 are vulnerable to Cross-Site Request Forgery (CSRF). This issue allows attackers to perform actions on behalf of users without their consent. The vulnerability affects WordPress installations with the Patreon plugin, requiring defenders to verify user interactions and assess exposure. The technical impact involves potential unauthorized actions due to the CSRF vulnerability.

Defensive priority

Defenders should prioritize verifying user interactions and assessing exposure to this CSRF vulnerability in the Patreon WordPress plugin.

Recommended defensive actions

  • Verify user interactions with the Patreon WordPress plugin
  • Assess exposure to this CSRF vulnerability
  • Prioritize remediation of the Patreon WordPress plugin to version 1.10.0 or later

Evidence notes

The CVE record and source item provide details on the CSRF vulnerability in the Patreon WordPress plugin. The NVD entry is currently not provided. Evidence is limited to CVE Program and source item details. Defenders should verify the vulnerability's impact on WordPress installations with the Patreon plugin and review official advisories for affected scope and severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108479 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108479

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108479 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108479

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.