The vulnerability is a classic Cross‑Site Request Forgery flaw that allows an attacker to trigger requests on behalf of an authenticated user. The flaw exists in the Patreon WordPress plugin version 1.10.0 and earlier. A successful exploitation can lead to unauthorized changes or actions performed under the victim’s credentials, potentially resulting in data alteration or loss of control over the WordPress site. The CVSS score of 7.4 indicates that the exploit carries a high severity impact.

The issue affects the Patreon WordPress plugin from its earliest release through version 1.10.0. All WordPress sites that have installed any of those versions are susceptible; no specific patches are available for older version numbers beyond the stated limit.

The CVSS metric of 7.4 reflects a significant threat if the attacker can coerce a user into visiting a malicious page while their browser holds an active session cookie. No EPSS data is supplied, and the vulnerability is not listed in the CISA KEV catalog, so the measured likelihood of exploitation is unknown. The attack path typically requires an authenticated user to click or navigate to a crafted link; once triggered, the plugin processes the request without validating the origin, enabling a CSRF attack. Because no additional constraints such as token checks are described, the vulnerability can be exploited by relatively simple social‑engineering or drive‑by scenarios.