Patreon WordPress EUVD-2026-103251

Exploitation requires that a user with administrator privileges who is actively logged into the WordPress site be tricked into loading an attacker-controlled request (CSRF), and requires the site to be running the Patreon WordPress plugin at a version before 1.10.0 with the Patreon integration connect feature in use. The specific trigger is the account-connect/re-link action, which does not verify a CSRF nonce. Limiting factors: the attack needs an authenticated admin session plus active social-engineering-driven user interaction (UI:R) - it cannot be performed purely remotely without a victim admin; it does not work on sites already updated to 1.10.0 or later, and it grants no direct code execution or data disclosure, only takeover of the Patreon integration (integrity impact).

This is a CSRF vulnerability (CWE-352) with a CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). The signals are internally consistent: network vector, low complexity, no attacker privileges, but mandatory user interaction (a logged-in administrator must be lured into triggering a crafted request), with a high integrity impact and no confidentiality or availability impact. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization - this is a moderate-severity, not critical, issue whose real-world risk is gated primarily by the need to trick an authenticated admin. No SSVC decision data was supplied. The dependence on administrator interaction (UI:R) and the single-scope, integrity-only impact mean this is a credible but not drop-everything priority; it should be patched in normal cycles, prioritized higher for sites where the Patreon integration handles revenue/membership gating. Note: no EPSS, KEV, POC, or SSVC values were present in the input, so exploitation-likelihood signals beyond the CVSS vector are unavailable and this assessment leans on the CVSS vector and description alone.

An attacker crafts a malicious web page or email containing an auto-submitting request targeting the plugin's Patreon-connect endpoint, which lacks nonce verification. When a logged-in WordPress administrator visits the page, their browser silently re-links the site's Patreon integration to an attacker-controlled Patreon account. No public exploit code was identified at time of analysis, but CSRF of this kind is straightforward to construct once the vulnerable endpoint is known.