The Patreon WordPress plugin prior to version 1.10.0 does not enforce an authorization check for its taxonomy and term enumeration features. This flaw allows any visitor to request taxonomy data and obtain the names of terms across all taxonomies, including those that are normally hidden from public view in WordPress. Because the data is exposed before authentication, the vulnerability can leak structural information about the site’s content organization, which might assist attackers in planning further attacks.

WordPress sites that employ the Patreon WordPress plugin with a version number lower than 1.10.0 are impacted. The exact versions are not listed by the CNA, so any instance of the plugin installed prior to the 1.10.0 release is vulnerable.

The vulnerability is exploitable without authentication and can be reached through normal website traffic to the plugin’s API endpoints. The CVSS score is not disclosed, and EPSS data is unavailable, so precise numerical risk cannot be supplied. However, because the flaw permits unauthenticated enumeration of potentially sensitive taxonomy data, the risk to confidentiality is significant and should be mitigated promptly. The issue is not currently included in the CISA Known Exploited Vulnerabilities catalog.