---
id: "CVE-2026-92431"
kind: "vulnerability"
aliases: ["CVE-2026-92431"]
title: "Patreon WordPress plugin: unauthenticated users can list taxonomy term names"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "patreon-plugin", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-17T06:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:45:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92431", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Patreon WordPress plugin: unauthenticated users can list taxonomy term names

The Patreon WordPress plugin before 1.10.0 skips an authorization check on some functionality. An unauthenticated visitor can enumerate the names of terms in any taxonomy, including private taxonomies WordPress does not show on the front end.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Patreon plugin version in the WordPress admin Plugins screen or with `wp plugin get patreon --field=version`
- unknown

## Fix

- Update the Patreon WordPress plugin to `1.10.0` or later
- unknown

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92431

## From the sources

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_