The Patreon WordPress plugin prior to version 1.10.0 does not enforce an authorization check for its taxonomy and term enumeration features (CWE‑862). This flaw allows any visitor to request taxonomy data and obtain the names of terms across all taxonomies, including those that are normally hidden from public view in WordPress. Because the data is exposed before authentication, the vulnerability permits information disclosure, potentially leaking structural information about the site’s content organization, which might assist attackers in planning further attacks.

WordPress sites that employ the Patreon WordPress plugin with a version number lower than 1.10.0 are impacted. The exact versions are not listed by the CNA, so any instance of the plugin installed prior to the 1.10.0 release is vulnerable.

The vulnerability is exploitable without authentication and can be reached through normal website traffic to the plugin’s API endpoints. It represents a chain of weaknesses: missing authentication (CWE‑862) that ultimately leads to information disclosure. The CVSS score is 3.7, and the EPSS Score is < 1%, indicating a low likelihood of exploitation. However, because the flaw permits unauthenticated enumeration of potentially sensitive taxonomy data, the risk to confidentiality is significant and should be mitigated promptly. The issue is not currently included in the CISA Known Exploited Vulnerabilities catalog.