PT-2026-51041 · Wpmu Dev · Branda – White Label & Branding

Thevietronin · Publicado 2026-06-19 · Atualizado 2026-06-20 · CVE-2026-11551

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2026-11551

Produtos afetados

Branda – White Label & Branding

Referências · 4

• https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php · Nota
• https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.29/inc/modules/login-screen/signup-password.php#L232 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-11551 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=cve · Nota