The Patreon WordPress plugin version 1.10.0 and earlier fails to verify a nonce during the linking process to a Patreon account. This omission allows an attacker to craft a cross‑site request—leveraging the CSRF weakness—to force a logged‑in administrator to re‑link the site’s Patreon integration to an attacker‑controlled account. Once re‑linked, the attacker gains control of the integration, potentially manipulating content posted to Patreon, injecting spam, or using the integration for malicious purposes. The vulnerability arises from incomplete request validation, which is a classic CSRF flaw.

This issue affects the Patreon WordPress plugin, specifically all releases prior to version 1.10.0. The plugin is used by WordPress sites that integrate with Patreon to share content or updates. Administrators running any pre‑1.10.0 build are vulnerable until they migrate to the patched version. No other vendors are listed; the component is identified only as the Patreon plugin.

The vulnerability is exploitable by local administrators who can be tricked into visiting a malicious link or loading a crafted request. Because the attacker only needs to induce the administrator to perform a normal request, no privileged system access is required beyond the administrator session. The EPSS score is < 1%, indicating a low exploitation probability, and the CVSS score is 6.5, reflecting moderate severity. However, the attack vector is well‑understood CSRF, and the vulnerability is listed as not in the CISA KEV catalog. The combination of administrative privilege and missing nonce verification results in a high risk of integration takeover if an attacker can lure an admin to a malicious URL.