CVE-2026-92432 in Patreon Plugin
Summary
by MITRE • 10/17/2026
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in the Patreon WordPress plugin prior to version 1.10.0 represents a classic instance of an Unvalidated Redirect and Forward flaw. This security defect arises from the application's failure to perform adequate validation on user-supplied input that dictates the destination of a redirect operation. Specifically, when users interact with certain features or links within the Patreon integration, the plugin accepts a URL parameter without verifying its legitimacy against a predefined allowlist or ensuring it points to an internal domain. This lack of sanitization allows external actors to manipulate the redirect logic by injecting malicious URLs into the request parameters.
From a technical perspective, this flaw exploits the trust that browsers and users place in the origin server's responses. When a user clicks on a crafted link containing a manipulated destination URL, the Patreon plugin processes the input and issues an HTTP 3xx response code directing the browser to the attacker-controlled domain. Because the redirect originates from the legitimate Patreon WordPress site, victims are likely to perceive the subsequent phishing page as trustworthy or official. This technique is particularly effective because it bypasses many basic security filters that rely on checking if a link leads away from the current domain, as the initial click appears safe and authoritative.
The operational impact of this vulnerability is significant, primarily facilitating social engineering attacks such as credential harvesting and malware distribution. Attackers can host phishing pages designed to mimic Patreon’s login interface or other sensitive forms, tricking users into submitting their credentials, personal information, or financial data. Since the initial redirect comes from a reputable source, the psychological barrier for victims is lowered, increasing the success rate of these attacks. Furthermore, this vulnerability affects unauthenticated attackers, meaning no prior access to the WordPress installation or user account is required to exploit it, thereby expanding the attack surface considerably.
In terms of industry classification standards, this issue aligns with CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect). It also maps closely to MITRE ATT&CK technique T1583.002, specifically Domain Registration for Phishing, as the vulnerability is often a precursor step in establishing credible phishing infrastructure by leveraging trusted domains to direct traffic to malicious endpoints. The exploitation of this flaw does not require complex payload construction but rather precise parameter manipulation within HTTP requests targeting specific plugin endpoints that handle redirection logic.
To mitigate this risk, site administrators must upgrade the Patreon WordPress plugin to version 1.10.0 or later, where the developers have implemented proper validation mechanisms for redirect destinations. These mitigations typically involve implementing an allowlist of approved domains or validating that the target URL belongs to the same origin as the application. Additionally, organizations should employ Web Application Firewalls configured with rulesets capable of detecting and blocking open redirect attempts based on parameter anomalies. Regular security audits and code reviews focusing on input validation for redirection functions are essential practices to prevent similar vulnerabilities in future updates or other plugins integrated into the WordPress ecosystem.