Low severity · published Oct 17, 2026
CVE-2026-92431
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
3.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
Patreon WordPress ·
before 1.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92431
wpscan.com
https://wpscan.com/vulnerability/58797977-b859-4637-898d-d82675c36eea/
More from Patreon WordPress
6.5
CVE-2026-92433
Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
5.5
CVE-2021-25026
Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
4.3
CVE-2026-92432
Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter