Live › vulnerability › CVE-2026-92432
Go to dashboardThe Patreon WordPress plugin before 1.10.0 redirects visitors to a destination taken from the request without checking it. An attacker can craft a link on the site's domain that sends users to any external URL, which is useful for phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Patreon WordPress plugin at a version before . The flaw is a redirect on the site's own domain, so the exposure is for the site's visitors and users rather than the server itself. Sites without the plugin installed, or running or later, can skip it.
1.10.01.10.0No product ranges from the sources yet.
wp plugin get patreon --field=version if WP-CLI is available.1.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-92432")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.