CVE-2026-108479 in Connect Plugin
Summary
by MITRE • 10/12/2026
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw represents a classic Cross-Site Request Forgery (CSRF) vulnerability within the Patreon integration plugin for WordPress, specifically affecting versions ranging from initial release up to version 1.9.17. This type of attack exploits the trust that a web application has in the user's browser, allowing an attacker to trick authenticated users into performing unintended actions on behalf of themselves without their knowledge or consent. In this specific context, the patreon-connect component fails to implement adequate anti-CSRF protections such as unique per-session tokens or strict validation of the Origin and Referer headers during state-changing requests. This architectural oversight means that any request sent by a logged-in user's browser is processed with full administrative privileges associated with their Patreon account integration within WordPress, regardless of whether the request originated from a legitimate source or a malicious third-party site controlled by an attacker.
From a technical perspective, the vulnerability stems from the absence of synchronization between client-side state and server-side action validation. When a user logs into their WordPress dashboard where the Patreon plugin is active, they receive authentication cookies that are automatically attached to subsequent HTTP requests made by their browser. If these requests do not include a cryptographically secure anti-CSRF token or if the server does not strictly verify the source of the request against an allowlist, malicious actors can craft HTML pages containing hidden forms or JavaScript-driven AJAX calls targeting the vulnerable endpoints exposed by patreon-connect. Upon visiting this crafted page while still logged into their WordPress instance, users inadvertently trigger these requests, leading to unauthorized modifications such as changing subscription settings, altering payment methods, or potentially exposing sensitive user data linked to their Patreon profile.
The operational impact of this vulnerability is significant for both individual creators and platform administrators who rely on the seamless integration between WordPress content management systems and Patreon membership platforms. An attacker could manipulate a creator's account to redirect payments to fraudulent accounts, disable premium access controls thereby allowing unauthorized users to view paid content without subscription, or alter notification preferences to disrupt communication with their community. Furthermore, if the compromised context allows for broader administrative actions within WordPress due to insufficient privilege separation between plugin functions and core CMS capabilities, the attacker might escalate privileges further, potentially gaining control over the entire website infrastructure. This not only results in direct financial loss but also severely damages the trust relationship between content creators and their audience, as well as undermining the integrity of the Patreon platform itself by facilitating abuse through its official integration channels.
To mitigate this risk, immediate action is required to update the affected WordPress plugin to a version newer than 1.9.17 where these security controls have been implemented. Developers should ensure that all state-changing HTTP methods such as POST, PUT, and DELETE are protected using anti-CSRF tokens generated per session and validated on every request. Additionally, implementing strict SameSite cookie attributes can provide an additional layer of defense by instructing browsers to not send cookies in cross-site requests unless explicitly allowed. For organizations unable to update immediately due to compatibility constraints, deploying a Web Application Firewall (WAF) with rules specifically targeting CSRF patterns or restricting access to the plugin's endpoints via IP whitelisting for administrative interfaces can serve as temporary compensating controls. Regular security audits and adherence to OWASP guidelines are essential to prevent similar vulnerabilities in future updates.
This vulnerability is categorized under CWE-352, which defines Cross-Site Request Forgery as a weakness where an attacker causes the user agent of a victim to perform unwanted actions on a trusted application. In terms of offensive tactics, this aligns with MITRE ATT&CK technique T1089, Disabling Security Tools, if the CSRF leads to disabling security features, or more broadly falls under Initial Access and Execution phases where social engineering is used to leverage valid credentials for malicious purposes. Understanding these classifications helps in mapping defense strategies effectively against known threat actor behaviors. The resolution requires not just a patch but also an awareness of how web applications handle session management and request validation to ensure that trust boundaries are strictly enforced between the client, the server, and third-party integrations like Patreon.