Patreon WordPress EUVD-2026-97729

Exploitation requires a victim who is currently authenticated to the WordPress site (typically an administrator or privileged user) to be tricked into interacting with attacker-controlled content (UI:R), because CSRF abuses the victim's existing session rather than attacker credentials. The core precondition is that the patreon-connect plugin (any version up to 1.10.0) performs a state-changing action without a valid anti-CSRF nonce/token check. Limiting factors that reduce realistic risk: the attack fails if no privileged user is logged in, if the user does not follow the malicious link, or if the site enforces SameSite cookies or other CSRF mitigations at the platform level. No special non-default plugin configuration is indicated in the description.

This is a CWE-352 Cross-Site Request Forgery flaw in the Patreon WordPress (patreon-connect) plugin, affecting all versions up to and including 1.10.0. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H, score 7.4) indicates a network-exploitable, low-complexity attack requiring no attacker privileges but DOES require user interaction (UI:R) - characteristic of CSRF, where a logged-in victim must be lured into triggering a forged request. The vector reports a scope change (S:C) and an availability-only impact (A:H) with no confidentiality or integrity impact, which is somewhat atypical for CSRF (which usually produces an integrity/state-change impact) and should be verified against the Patchstack advisory. On exploitation signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no proof-of-concept is referenced, so this is best treated as no public exploit identified at time of analysis. CSRF requires a social-engineering step (tricking an authenticated user into visiting a malicious page), which lowers real-world exploitability versus a fully unauthenticated server-side bug. Net assessment: a legitimately medium-to-high severity web issue worth patching, but NOT an emergency - absent KEV, EPSS, or POC evidence, there is no indication of active or imminent widespread exploitation. The score is driven largely by the S:C/A:H choices, which warrant vendor confirmation.

An attacker crafts a malicious web page or email containing a forged request targeting the Patreon WordPress plugin and lures an authenticated WordPress user (e.g., an administrator) into visiting it. Because the plugin does not validate an anti-CSRF nonce, the victim's browser silently submits the state-changing request using their active session. No public proof-of-concept is referenced, and the attack depends on the victim being logged in and clicking the attacker-controlled link (UI:R).