EUVD-2026-103252
GHSA-vv83-mghr-rv2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated request to plugin endpoint
-
ExploitBypass absent authorization check
-
ImpactEnumerate names of private taxonomy terms
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a target running the Patreon WordPress plugin at a version below 1.10.0 with the affected (unauthenticated-accessible) functionality reachable; the site must also define non-public taxonomies for the disclosure to be meaningful. No authentication, credentials, or user interaction are needed (PR:N/UI:N). Limiting factors: impact is confined to leaking taxonomy term names (no post content, PII, credentials, or write access), and value depends on the site actually using private/custom taxonomies - on sites with only standard public taxonomies the leaked data is negligible. |
| Impact | This is a genuine-but-low-priority information-disclosure flaw, not a high-impact issue. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) shows network reach and no authentication (PR:N) but only Low confidentiality impact and no integrity/availability effect - consistent with CWE-862 (Missing Authorization) that leaks the names of taxonomy terms rather than sensitive data. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three real-world exploitation signals are either absent or negative; absence of EPSS is a data gap, not evidence of risk. The provided vector's AC:H (high attack complexity) is questionable for a simple missing-authorization endpoint - a straightforward unauthenticated request would normally be AC:L - so the official 3.7 score may understate the ease of triggering while correctly reflecting the minor impact. Net: a real bug worth patching on the normal update cycle, but it exposes only term/label strings from non-public taxonomies and is not an urgent, widely-weaponized threat. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the Patreon plugin's unprotected functionality on a target WordPress site and receives back the names of terms from taxonomies that WordPress normally hides from the front end, revealing internal labels (e.g. membership tiers or private categorizations). Because the vector is AV:N/PR:N, no account or user interaction is needed, but the disclosed data is limited to term names (C:L). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Unauthenticated term-name enumeration in the Patreon WordPress plugin (versions below 1.10.0) lets remote attackers query taxonomy terms, including non-public and custom taxonomies that WordPress normally keeps off the front end. Successful exploitation leaks only the names of terms, not post content, credentials, or personally identifiable information, and no write access is gained, so the practical value depends on whether a site defines private or otherwise non-public taxonomies whose labels are themselves sensitive (for example internal customer segments or unpublished categorization schemes). The assessed vector (AV:N/AC:L/PR:N/UI:N, C:L) reflects a low-impact but easily reachable disclosure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 1.10.0 to address the missing authorization check.
RemediationAI
Upgrade the Patreon WordPress plugin to 1.10.0 or later, which restores the authorization check on the affected term-enumeration functionality; this is the only complete fix and should be applied through the WordPress plugin updater or by deploying the 1.10.0 package from the vendor. Where an immediate update is not possible, reduce exposure by fronting the site with a WAF or reverse-proxy rule that blocks unauthenticated requests to the plugin's term-query endpoints (identifiable from the WPScan write-up at https://wpscan.com/vulnerability/58797977-b859-4637-898d-d82675c36eea/), accepting that overly broad rules may break legitimate Patreon sync or front-end features; alternatively, deactivate the plugin until patched, which removes the exposure entirely but disables Patreon membership integration and any gated-content functionality. As a data-minimization measure, review registered taxonomies and avoid encoding sensitive information in term names for non-public taxonomies, since term labels remain queryable by any plugin code that omits capability checks. Audit logs for unauthenticated requests hitting plugin term-lookup routes to detect prior probing; note that no vendor patch bypass or exploit code was publicly identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing authorization check (CWE-862) in the Patreon WordPress plugin, which registers functionality that handles taxonomy queries and term lookups. Because that code path lacks a capability or nonce/authorization gate, a request from an unauthenticated visitor (the assessed vector carries PR:N and UI:N) can reach the term-listing logic and receive term names for any registered taxonomy - including taxonomies registered with public-facing exposure disabled, which core WordPress would not render or expose to anonymous users. WordPress taxonomy registration (register_taxonomy with public/show_ui settings) is a soft visibility control rather than an access control: term data still lives in the terms and term_taxonomy tables and is retrievable by any code that calls get_terms() without a current_user_can() or similar check. Consequently the plugin's oversight, rather than a flaw in WordPress core, is the root cause. The information exposed is limited to term names/slugs; the vector's Confidentiality:Low and unchanged scope reflect that only labels in non-public taxonomies are disclosed, with no integrity or availability impact and no path to privilege escalation on its own. Sites using only the standard public categories and tags gain essentially nothing from the leak, which is why the issue is characterized as genuine but low priority.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Missing authorization lets any unauthenticated remote user hit the endpoint directly (AV:N/AC:L/PR:N/UI:N); only term names leak, so C:L with no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB