CVE-2026-108479: Cross-Site Request Forgery (CSRF) in Patreon Patreon WordPress

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Patreon WordPress plugin (patreon-connect). It affects all versions from initial release through 1.9.17 (expressed as >=0 <1.10.0). An attacker could exploit this flaw to trick an authenticated user into executing unwanted actions without their consent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of authenticated users, potentially leading to disclosure or modification of sensitive information. There is no reported impact on system availability. The high CVSS score reflects significant confidentiality and integrity risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider implementing CSRF protections such as verifying request origins or using anti-CSRF tokens where possible.