CVE-2026-92433 Patreon CVE debrief

Who should care

Administrators of WordPress sites using the Patreon plugin should be aware of this vulnerability and take steps to address it. This includes verifying the plugin version, implementing CSRF protection measures, and monitoring for suspicious activity related to the Patreon integration. Additionally, security teams and vulnerability management teams should review the vulnerability and plan for remediation.

Why it matters

The Patreon WordPress plugin before 1.10.0 has a CSRF vulnerability that allows attackers to take over the site's Patreon integration. Administrators of WordPress sites using this plugin should verify the plugin version and consider updating to version 1.10.0 or later.

• An attacker could take over the site's Patreon integration by crafting a request that a logged-in administrator would unintentionally execute.
• The vulnerability requires an administrator to be logged in and tricked into re-linking the integration to an attacker-controlled account.
• Verification of the plugin version and implementation of CSRF protection measures are necessary to address this vulnerability.

Technical summary

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF). This vulnerability affects WordPress sites using the Patreon plugin, particularly those with administrator-level access. The vulnerability allows an attacker to craft a request that a logged-in administrator would unintentionally execute, potentially leading to the takeover of the site's Patreon integration.

Defensive priority

Administrators of WordPress sites using the Patreon plugin should verify the plugin version and consider updating to version 1.10.0 or later to address the CSRF vulnerability.

Recommended defensive actions

• Verify the Patreon WordPress plugin version and update to 1.10.0 or later
• Implement CSRF protection measures for the Patreon plugin
• Monitor for suspicious activity related to the Patreon integration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by WPScan, and the CVE record was created based on this report. The NVD entry is currently Received. The Patreon WordPress plugin before 1.10.0 has a CSRF vulnerability that allows attackers to take over the site's Patreon integration. The vulnerability requires an administrator to be logged in and tricked into re-linking the integration to an attacker-controlled account. Verification of the plugin version and implementation of CSRF protection measures are necessary to address this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.