Cross-Site Request Forgery in Patreon WordPress Plugin by Patreon
CVE-2026-92433
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 17 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-92433?
The Patreon WordPress plugin prior to version 1.10.0 is susceptible to a Cross-Site Request Forgery vulnerability that bypasses nonce verification. This weakness allows an attacker to create a malicious request that can manipulate a logged-in administrator's session. By leveraging this vulnerability, the attacker can force the administrator to re-establish the site's connection to a Patreon account controlled by the attacker, potentially compromising the site's integration with Patreon and leading to unauthorized access.
Affected Version(s)
Patreon WordPress 0 < 1.10.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.