CVE-2026-92433: Unknown Patreon WordPress

EPSS: 0.1% chance of exploitation in the next 30 days.

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.

Affected products

• Unknown Patreon WordPress: before 1.10.0 (fixed in 1.10.0)

Published 2026-10-17. Last modified 2026-10-17.