CVE-2026-108481: WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Q: Does exploiting this issue require an authenticated WordPress account?

No privileges are required according to the CVSS vector (PR:N). Exploitation does require user interaction (UI:R) and can be conducted over the network (AV:N).

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector indicates a high availability impact (A:H), with no stated confidentiality or integrity impact (C:N/I:N). The issue has changed scope (S:C).

Q: Which installations should be considered affected?

The affected range is listed as Patreon WordPress versions through 1.10.0. No fixed version or mitigation is provided in the available data.

Published Oct 12, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

Affected Software

1 affected component

Patreon Patreon WordPress<=1.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Patreon WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.11.0

Event History

Oct 12, 2026

CVE Published

via MITRE·05:33 PM

Data Sourced

via MITRE·05:33 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress account?

No privileges are required according to the CVSS vector (PR:N). Exploitation does require user interaction (UI:R) and can be conducted over the network (AV:N).

What is the expected security impact if exploitation succeeds?