Threats tagged 'ghsa-w3q2-34vh-jqmw'

The Patreon WordPress plugin versions before 1.10.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to trick a logged-in administrator into re-linking the site's Patreon integration to an attacker-controlled account via a crafted request. The vulnerability arises because the plugin does not verify a nonce during the connection process. Exploitation can lead to takeover of the site's Patreon integration.