Vulnerabilities and security researches forpatreon-connect patreon-connect

Oct 14, 2026

CVE, Research URL: CVE-2026-108481
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Oct 12, 2026
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
Affected versions: max 1.11.0.
Status: vulnerable

CVE, Research URL: CVE-2026-108479
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Oct 12, 2026
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
Affected versions: max 1.10.0.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 9d55a4f0c185e98d56251ed0a25aa91a0c06468b
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Mar 26, 2021
Research Description: Patreon WordPress [patreon-connect] < 1.7.0 WordPress Patreon WordPress plugin <= 1.6.9 - Cross-Site Request Forgery (CSRF) vulnerability allowing overwrite/create user meta Cross-Site Request Forgery (CSRF) vulnerability allowing overwrite/create user meta discovered by Jetpack Scan team in WordPress Patreon WordPress plugin (versions <= 1.6.9).
Affected versions: max 1.7.0.
Status: vulnerable

Jan 26, 2025

CVE, Research URL: CVE-2025-24588
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Jan 24, 2025
Research Description: Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
Affected versions: max 1.9.2.
Status: vulnerable

Jul 02, 2024

CVE, Research URL: CVE-2024-37430
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Jul 09, 2024
Research Description: Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0.
Affected versions: max 1.9.1.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2021-24228
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Apr 12, 2021
Research Description: The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
Affected versions: max 1.7.2.
Status: vulnerable

CVE, Research URL: CVE-2018-20984
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Aug 22, 2019
Research Description: The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
Affected versions: max 1.2.2.
Status: vulnerable

CVE, Research URL: CVE-2021-24231
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Apr 12, 2021
Research Description: The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Affected versions: max 1.7.0.
Status: vulnerable

CVE, Research URL: CVE-2021-24227
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Apr 12, 2021
Research Description: The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Affected versions: max 1.7.0.
Status: vulnerable

CVE, Research URL: CVE-2021-25026
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Mar 14, 2022
Research Description: The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected versions: max 1.8.2.
Status: vulnerable

CVE, Research URL: CVE-2023-41129
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Nov 19, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6.
Affected versions: max 1.8.8.
Status: vulnerable

CVE, Research URL: CVE-2021-24229
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Apr 12, 2021
Research Description: The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
Affected versions: max 1.7.2.
Status: vulnerable

CVE, Research URL: CVE-2021-24230
Home page URL: Security reports for Patreon WordPress
Application: Patreon WordPress
Date: Apr 12, 2021
Research Description: The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Affected versions: max 1.7.0.
Status: vulnerable