CVE-2026-92432: Unknown Patreon WordPress

EPSS: 0.1% chance of exploitation in the next 30 days.

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.

Affected products

• Unknown Patreon WordPress: before 1.10.0 (fixed in 1.10.0)

Published 2026-10-17. Last modified 2026-10-17.