Description
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Patreon WordPress | < 1.10.0 | 1.10.0 |
References
- https://wpscan.com/vulnerability/ea970f2e-0fe8-4fef-99ff-a74255fa5a04/ exploit vdb-entry technical-description