Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-92431: Patreon WordPress plugin can reveal hidden taxonomy names
CVE-2026-92431 · published 1 day ago
Summary
The Patreon plugin for WordPress (versions before 1.10.0) lets anyone on the internet see the names of categories or tags, even those meant to stay private. This exposure could give attackers insight into your site’s internal structure. Update the plugin to version 1.10.0 or later to stop the information leak.
What to do
- Update unknown patreon wordpress to version 1.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | patreon wordpress | < 1.10.0 |
Original advisory text
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.7
Low
Type
CWE-862Missing Authorization
Timeline
Published17 Oct 2026
Updated18 Oct 2026
First seen17 Oct 2026
Track software like this
Free during beta