CVE-2026-92431
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
- State
- Published
- Severity
- 3.7 Low
- Published
- Oct 17, 2026
- Updated
- Oct 18, 2026
- Reserved
- Sep 16, 2026
Description
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Patreon WordPressUnknown |
|
References
- https://wpscan.com/vulnerability/58797977-b859-4637-898d-d82675c36eea/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.