Patreon WordPress EUVD-2026-103253

Exploitation requires the attacker to craft a link targeting the Patreon WordPress plugin's redirect functionality with a user-supplied destination parameter that the plugin fails to validate against an allowlist before redirecting (CWE-601). The decisive limiting factor is required user interaction (UI:R): a victim must actually click the attacker-supplied link, so this cannot be triggered server-side or automatically. Impact is confined to redirecting the browser to an arbitrary external URL (I:L) - there is no code execution, data disclosure, or availability impact - meaning the flaw only enables phishing by borrowing the trusted site's domain reputation. Affects default installations of the plugin at any version below 1.10.0; no authentication is required of the attacker.

This is a genuinely low-to-moderate priority issue despite a 'MEDIUM' label. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) is internally consistent: network-reachable, low-complexity, unauthenticated (PR:N), but gated by user interaction (UI:R) with only limited integrity impact (I:L) and zero confidentiality or availability impact - appropriate for an open redirect (CWE-601). No EPSS score, KEV listing, or POC reference was provided in the input, so there is no signal of active exploitation or available exploit code; per the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The signals do not conflict - they uniformly point to a facilitation-class flaw whose damage is indirect (it aids phishing/credential-harvesting campaigns rather than directly compromising the host). Treat as a hygiene patch, not an emergency: real risk depends entirely on attackers folding the redirect into a social-engineering campaign.

An attacker crafts a link pointing to the vulnerable Patreon plugin endpoint on a trusted WordPress site, embedding an attacker-controlled external URL as the redirect destination, then distributes it via email or social media. A victim who trusts the legitimate domain clicks the link and is silently redirected to an attacker-controlled phishing page. No public exploit code was identified in the provided data, but open-redirect abuse requires only a crafted URL and no special tooling.