CVE-2021-24231: vulnerability in Patreon WordPress
Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Affected products
Unknown · Patreon WordPressRelated CVEs — Patreon WordPress
In the same product, most dangerous first.
CVE-2021-24227—Patreon WordPress < 1.7.0 - Unauthenticated Local File DisclosureEPSS 5.9%CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%CVE-2021-25026—Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24230—Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User MetaEPSS 0.6%CVE-2026-92431LOWPatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationEPSS 0.2%