PT-2026-51041 · Wpmu Dev · Branda – White Label & Branding

Thevietronin · Published 2026-06-19 · Updated 2026-06-20 · CVE-2026-11551

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-11551

Affected Products

Branda – White Label & Branding

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-11551 · Security Note
• https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php · Note
• https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.29/inc/modules/login-screen/signup-password.php#L232 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=cve · Note