Patreon WordPress plugin: Cross-Site Request Forgery
Summary
The Patreon WordPress plugin (patreon-connect) up to and including version 1.9.17 contains a Cross-Site Request Forgery vulnerability (CWE-352). An attacker can trick a logged-in user, typically a WordPress administrator, into visiting a crafted page that triggers actions on the site without their intent. The affected function is not publicly documented, and the CVSS vector requires user interaction, with high confidentiality and integrity impact.
Affected
- Patreon WordPress plugin (patreon-connect) up to and including 1.9.17
Fixed in
- Version 1.10.0 or later (Patchstack).
- Verify the installed version, because the related CVE-2026-108481 is listed as requiring at least 1.11.0.
- Latest release according to the plugin listing: 1.13.0.
Workaround
- No vendor workaround known.
- If an update is not possible immediately, deactivate the plugin if it is not essential.
- Administrators should log out after admin work and not browse other sites while logged in.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable.
- VulDB: no available exploit.
- EPSS very low (0.00128).
Our recommendation
- Identify all WordPress sites running patreon-connect version 1.9.17 or lower.
- Update to the latest release, at least 1.10.0, and verify the installed version.
- Remove the plugin if it is not used.
- Ensure administrators log out after admin work and avoid browsing other sites while logged in.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-108479 app.opencve.io
- VulDB 417108 vuldb.com
- HOL Guard CVE-2026-108479 hol.org
- HOL Guard CVE-2026-108481 (related) hol.org
- Rapid7 via Vulners vulners.com
- WPScan CSRF precedent wpscan.com
- InstaWP plugin listing instawp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:58.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.