{"id":"CVE-2026-11551","aliases":["EUVD-2026-38097","GHSA-r464-rgh8-qf85"],"status":"published","title":"Branda – White Label \u0026 Branding, Free Login Page Customizer \u003c= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover","description":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00648,"percentile":0.51585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-640"],"published":"2026-06-19T23:29:21Z","modified":"2026-06-23T03:16:40Z","exploits":[{"source":"pocgithub","id":"Polosss/By-Poloss..-..CVE-2026-11551-PoC","title":"Polosss/By-Poloss..-..CVE-2026-11551-PoC","date":"2026-06-19","url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-11551-PoC"},{"source":"pocgithub","id":"ubaydev/CVE-2026-11551-PoC","title":"ubaydev/CVE-2026-11551-PoC","date":"2026-06-21","url":"https://github.com/ubaydev/CVE-2026-11551-PoC"}],"products":[{"vendor":"wpmudev","product":"branda – white label \u0026 branding, free login page customizer"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.29/inc/modules/login-screen/signup-password.php#L232"},{"url":"https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11551"},{"url":"https://github.com/advisories/GHSA-r464-rgh8-qf85"}],"sources":{"cve":[{"id":"CVE-2026-11551","title":"Branda – White Label \u0026 Branding, Free Login Page Customizer \u003c= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover","description":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.","status":"published","published":"2026-06-19T23:29:21.99Z","modified":"2026-06-23T02:27:54.179Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:20:04.463704Z"}],"euvd":[{"id":"EUVD-2026-38097","description":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.","status":"published","published":"2026-06-19T23:29:21Z","modified":"2026-06-23T02:27:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:33.850201Z"}],"ghsa":[{"id":"GHSA-r464-rgh8-qf85","title":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all...","description":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.","status":"published","published":"2026-06-20T00:34:08Z","modified":"2026-06-20T00:34:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T15:08:55.672723Z"}],"nvd":[{"id":"CVE-2026-11551","description":"The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.","status":"published","published":"2026-06-20T00:16:15.58Z","modified":"2026-06-23T03:16:40.677Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:12:24.912854Z"}]}}