An earlier version of the Patreon WordPress plugin lacks validation of the user-supplied redirect destination. An unauthenticated attacker can craft a link that causes the plugin to redirect site visitors to an arbitrary external URL. This flaw directly enables phishing attacks by enticing users to click a link that appears to come from the legitimate site, but actually directs them to a malicious domain.

The vulnerability affects the Patreon WordPress plugin used on WordPress installations. Any instance running a version prior to 1.10.0 is vulnerable. The flaw can be exploited by any visitor clicking a malicious link, regardless of authentication status. No specific configuration settings mitigate the issue in versions below 1.10.0.

The CVSS score of 4.3 and EPSS of less than 1% suggest a moderate risk level, but the precise exploitation likelihood remains low. However, the lack of authentication and the straightforward ability to redirect users make the flaw attractive for phishing campaigns. Because the vulnerability is not listed in CISA’s KEV catalog, it has not yet been observed in widespread exploitation events.