Live › vulnerability › CVE-2026-92433
Go to dashboardThe Patreon WordPress plugin before 1.10.0 does not verify a nonce when linking the site to a Patreon account. An attacker can trick a logged-in administrator into visiting a crafted request that re-links the site's Patreon integration to an attacker-controlled account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Patreon WordPress plugin below version 1.10.0 where an administrator is logged in and could be tricked into following a link from an attacker. The risk is to the integration's Patreon account link, not direct server code execution. Sites on 1.10.0 or later, or without the plugin, can skip it.
No product ranges from the sources yet.
1.10.0 are affected.wp plugin get patreon --field=version if WP-CLI is available, comparing against 1.10.0.1.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
This page as .md · .json · in your agent: get_signal("CVE-2026-92433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.