A Cross‑Site Request Forgery vulnerability exists in the Patreon WordPress plugin called Patreon Connect. The flaw allows an attacker to craft a request that exploits an authenticated user’s session and forces the user to perform an unintended action on the site, such as changing account settings or authorizing payments. The vulnerability is based on inadequate protection against forged requests, classified as CWE‑352, and could lead to unauthorized changes, data disclosure, or fraudulent activity performed with the privileges of the logged‑in user.

The issue affects versions of the Patreon Connect WordPress plugin up to and including 1.9.17. The vendor, Patreon, offers the plugin on WordPress via the Patreon WordPress package. No specific minor or patch version information is provided beyond the upper bound of 1.9.17.

The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. The exploit probability is not available, but the lack of a warning in the CISA KEV catalog does not diminish the risk if the site is exposed to users who could be tricked into visiting a malicious link. Attackers typically prove the vulnerability by sending an authenticated user to a crafted URL that triggers the disallowed action; therefore, the primary attack vector is a social‑engineering or phishing campaign against site users.