What’s Vulnerable › Vulnerabilities
CVE-2026-92431: Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-17 · updated 2026-10-19
- Weakness: CWE-862
Description
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Affected products
- Patreon WordPress: before 1.10.0 — fixed in 1.10.0
How to fix
Upgrade to a fixed version: Patreon WordPress 1.10.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-92431 or the next vulnerability affects your stack