CVE-2026-92433: CWE-352 Cross-Site Request Forgery (CSRF) in Patreon WordPress

The Patreon WordPress plugin prior to version 1.10.0 fails to verify a nonce during the process of connecting the site to a Patreon account. This lack of verification enables a Cross-Site Request Forgery (CWE-352) attack, where an attacker can craft a request that causes a logged-in administrator to unknowingly re-link the Patreon integration to an account controlled by the attacker. This vulnerability allows the attacker to take over the site's Patreon integration functionality.

An attacker can hijack the Patreon integration of a WordPress site by exploiting the CSRF vulnerability, effectively gaining control over the Patreon account linkage. This could lead to unauthorized access or manipulation of Patreon-related features on the site. However, exploitation requires the victim to be a logged-in administrator who performs the action triggered by the malicious request.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links or performing Patreon integration actions from untrusted sources. Implementing nonce verification or other CSRF protections in the plugin code is recommended once a patch is released.