Patreon WordPress CVE-2026-108479

Exploitation requires an authenticated WordPress user - in practice an administrator - to be logged in and then tricked into visiting attacker-controlled content or clicking a crafted link (UI:R), which triggers a forged request to the Patreon Connect plugin lacking proper anti-CSRF nonce validation. The affected versions are Patreon WordPress (patreon-connect) from n/a through 1.9.17. Limiting factors: the attack fails if the victim is not currently authenticated, if the victim never interacts with the malicious content, or if the site runs a patched release beyond 1.9.17; the attacker gains only the privileges of the victimized session.

Signals are thin and partly conflicting. The input CVSS of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) treats this CSRF as high-impact, but the description provides no detail on what the forged request actually does, so the C:H/I:H claim is not substantiated by any available text - it appears to be a default Patchstack scoring posture rather than an evidenced impact. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent exploitation. Critically, PR:N reflects that the attacker needs no account, but UI:R means a logged-in victim (typically an administrator) must be tricked into submitting the forged request - a meaningful real-world limiter the raw 8.1 obscures. Net: this is a credible but not urgent issue - a patch-in-normal-cycle item rather than an emergency, and the true severity hinges on impact detail the advisory does not provide. Verify the actual affected action with Patchstack/vendor before accepting C:H/I:H.

An attacker hosts a malicious page or sends a link to a site administrator who is logged into WordPress; when the admin visits it, the page auto-submits a forged request to the Patreon plugin endpoint, performing a state-changing action under the admin's session. No public exploit code has been identified, and success depends on the admin being authenticated and interacting with attacker-controlled content.