Patreon
Monthly
Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.
Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.
Sites running the Patreon contributed module on the Drupal 7.x branch expose a high-privilege attack surface in CVE-2026-87941, which carries a CVSS score of 5.9 and can yield both high confidentiality and high integrity impact while leaving availability unaffected. Exploitation is network-reachable but gated behind an authenticated account holding high privileges (PR:H) and depends on conditions outside the attacker's direct control (AC:H), so anonymous and low-privileged users cannot trigger it, and no user interaction is required once those preconditions are met. Risk signals point to low real-world urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; the vuln.today decision label is this_month. The specific feature, configuration, or code path that triggers the flaw is not described in the available sources, so verification against Drupal advisory SA-CONTRIB-2026-139 is required before drawing conclusions about mechanism.
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.
Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.
Sites running the Patreon contributed module on the Drupal 7.x branch expose a high-privilege attack surface in CVE-2026-87941, which carries a CVSS score of 5.9 and can yield both high confidentiality and high integrity impact while leaving availability unaffected. Exploitation is network-reachable but gated behind an authenticated account holding high privileges (PR:H) and depends on conditions outside the attacker's direct control (AC:H), so anonymous and low-privileged users cannot trigger it, and no user interaction is required once those preconditions are met. Risk signals point to low real-world urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; the vuln.today decision label is this_month. The specific feature, configuration, or code path that triggers the flaw is not described in the available sources, so verification against Drupal advisory SA-CONTRIB-2026-139 is required before drawing conclusions about mechanism.
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.