An earlier version of the Patreon WordPress plugin lacks validation of the user-supplied redirect destination. An unauthenticated attacker can craft a link that causes the plugin to redirect site visitors to an arbitrary external URL. This flaw directly enables phishing attacks by enticing users to click a link that appears to come from the legitimate site, but actually directs them to a malicious domain.

The vulnerability affects the Patreon WordPress plugin used on WordPress installations. Any instance running a version prior to 1.10.0 is vulnerable. The flaw can be exploited by any visitor clicking a malicious link, regardless of authentication status. No specific configuration settings mitigate the issue in versions below 1.10.0.

The CVSS score and EPSS for this vulnerability are not provided in the supplied data, so the exact magnitude and exploitation likelihood are unknown. However, the lack of authentication and the straightforward ability to redirect users make the flaw attractive for phishing campaigns. Because the vulnerability is not listed in CISA’s KEV catalog at present, it has not yet been observed in widespread exploitation events.