# CVE-2026-92433: Patreon WordPress plugin CSRF in account linking

Source: https://junglewise.ai/threats/cve-2026-92433-the-patreon-wordpress-plugin-before-1-10-0-does-not-verify-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-92433 · Severity: info · Published 2026-10-17

The Patreon WordPress plugin allows site administrators to sell memberships and manage patron relationships directly from their WordPress site. An attacker can trick an authenticated administrator into re-linking the site's Patreon integration to an attacker-controlled account via a crafted web request, gaining complete control over the site's Patreon integration and potentially its revenue stream.

Vendors: [Patreon](https://junglewise.ai/threats/vendors/patreon).

## Quick answers

**Is CVE-2026-92433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92433 being exploited in the wild.

**How severe is CVE-2026-92433?** Informational severity, published 17 October 2026.

**Which products and versions are affected?** Patreon WordPress before 1.10.0.

**Is there a fix for CVE-2026-92433?** Yes: fixed in 1.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92433 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92433?** Check whether you run Patreon WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.0

## Technical details

The plugin fails to verify a nonce when administrators connect or re-link the site to a Patreon account, enabling Cross-Site Request Forgery (CSRF) attacks. An attacker crafts a malicious request targeting an authenticated admin user, causing them to unwittingly change the integration to point to an attacker-controlled Patreon account. Exploitation requires the victim to be logged in as an administrator and to visit an attacker-controlled page or click a malicious link.

## Affected products

- Patreon Patreon WordPress before 1.10.0

## Timeline

- 2026-10-14: disclosed
- 2026-10-17: advisory

## References

- [https://wpscan.com/vulnerability/ea970f2e-0fe8-4fef-99ff-a74255fa5a04/](https://wpscan.com/vulnerability/ea970f2e-0fe8-4fef-99ff-a74255fa5a04/)