Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

CVE-2026-87941

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x...

CVE-2026-87941

A security vulnerability exists in the Patreon module for Drupal , specifically affecting version 7.x . The Drupal Security Team has marked this project as unsupported because of a known security issue that remains unpatched by the maintainer. No specific technical details regarding the root caus...

CVE-2026-87941 Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x...

EUVD-2026-107860

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x...

PT-2026-120958

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x...

Drupal Patreon security vulnerability

A security vulnerability exists in Drupal Patreon version 7.x. It stems from an unknown error that allows remote administrators to pass specially crafted input to the application, thereby executing arbitrary code on the system...

CVE-2026-92432

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...

CVE-2026-92431

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...

CVE-2026-92433

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...

EUVD-2026-103253

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...

WordPress Patreon WordPress plugin < 1.10.0 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Patreon WordPress versions 1.10.0...

CVE-2026-92432 Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...

CVE-2026-92432 Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter

The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...

CVE-2026-92432

The Patreon WordPress plugin versions before 1.10.0 is vulnerable to an Open Redirect (CWE-601) because it fails to validate a user-supplied redirect destination. Unauthenticated attackers can use a crafted link to redirect visitors to an arbitrary external URL, which can be leveraged for phishin...

EUVD-2026-103252

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...

EUVD-2026-103251

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...

CVE-2026-92433 Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...

WordPress Patreon WordPress plugin < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration vulnerability

Unauthenticated Taxonomy and Term Enumeration vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...

WordPress Patreon WordPress plugin < 1.10.0 - Patreon Integration Takeover vulnerability

Patreon Integration Takeover vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...