Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects… (CVE-2026-108479)

The Patreon WordPress plugin 'patreon-connect' contains a CSRF vulnerability identified as CVE-2026-108479. This vulnerability affects all versions up to and including 1.9.17. It allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized changes or actions within the plugin context. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality and integrity, with no impact on availability. The attack vector is network-based, requiring no privileges but user interaction.

Successful exploitation of this CSRF vulnerability can lead to unauthorized actions being performed with the privileges of an authenticated user, potentially compromising confidentiality and integrity of user data or plugin settings. There is no indication of impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's security advisories for updates. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users only.