CVE-2026-92431 Patreon CVE debrief

Who should care

Defenders responsible for WordPress installations with the Patreon plugin should assess exposure and prioritize verification and remediation efforts. WordPress administrators and security teams should verify the Patreon plugin version and restrict access to sensitive taxonomies. This vulnerability could lead to information disclosure and potentially impact site security.

Why it matters

Defenders should care about CVE-2026-92431 because it allows unauthenticated users to enumerate taxonomy terms, potentially leading to information disclosure. WordPress administrators and security teams should verify the Patreon plugin version and restrict access to sensitive taxonomies.

• Potential enumeration of sensitive taxonomy terms
• Possible information disclosure
• Requires verification of Patreon WordPress plugin version
• May require additional access controls

Technical summary

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end. This vulnerability could lead to information disclosure and potentially impact site security. The affected product is the Patreon WordPress plugin, and defenders should verify the plugin version and restrict access to sensitive taxonomies. The CVE record and NVD entry provide limited information about the vulnerability.

Defensive priority

Defenders should prioritize verifying the Patreon WordPress plugin version and restricting access to sensitive taxonomies.

Recommended defensive actions

• Verify the Patreon WordPress plugin version and update to 1.10.0 or later if necessary
• Restrict access to sensitive taxonomies
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. Defenders should verify the Patreon WordPress plugin version and restrict access to sensitive taxonomies. The vulnerability allows unauthenticated users to enumerate taxonomy terms, potentially leading to information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.