Live › vulnerability › CVE-2026-92431
Go to dashboardThe Patreon WordPress plugin before 1.10.0 skips an authorization check on some functionality. An unauthenticated visitor can enumerate the names of terms in any taxonomy, including private taxonomies WordPress does not show on the front end.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Patreon WordPress plugin before 1.10.0 are exposed, since the flaw is in the plugin's own endpoints and needs no login. The sources do not say which plugin endpoint is affected or whether a site with the plugin set up differently is safe. Sites that do not run the plugin are not affected.
No product ranges from the sources yet.
wp plugin get patreon --field=version1.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
This page as .md · .json · in your agent: get_signal("CVE-2026-92431")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.