The Patreon WordPress "patreon-connect" plugin suffers from missing authorization that allows bypassing intended access controls. Consequently, users lacking proper privileges can access, modify, or disclose protected plugin data or functions, potentially enabling broader compromise of the site. The flaw is a classic broken access control weakness (CWE‑862).

All versions of the Patreon WordPress plugin up to and including 1.9.1 are affected. WordPress sites that have this plugin installed and configured in the vulnerable range are at risk. Versions newer than 1.9.1 are not impacted.

The CVSS rating of 6.5 denotes moderate severity while the EPSS score of less than 1 % indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would reach the plugin’s administrative or functional URLs, which are typically publicly accessible, and by sending crafted requests that bypass the missing authorization checks, could gain unauthorized access to privileged plugin operations. The exact attack path is not fully detailed in the CVE description, so the inferred attack vector assumes standard HTTP requests to vulnerable endpoints.