Patreon WordPress <= 1.6.9 - Cross-Site Request Forgery

The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.9. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content. This makes it possible for unauthenticated attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited via forged request granted they can trick a site administrator into performing an action such as clicking on a link.