CVE-2026-108479: WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Patreon WordPress pluginto a version that resolves this vulnerability.Fixed in 1.10.0
Event History
Frequently Asked Questions
What versions are affected?
The issue affects Patreon WordPress patreon-connect through version 1.9.17. The earliest affected version is not specified.
What does an attacker need to exploit this issue?
The attacker can attempt exploitation over the network without prior privileges, but a user must interact with a crafted request. The vulnerability is a CSRF issue, so exploitation depends on causing a user’s authenticated browser session to submit that request.
What is the potential impact?
Successful exploitation may result in high-impact confidentiality and integrity consequences. No availability impact is indicated by the supplied severity vector.