CVE-2026-11551CWE-640

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

Critical · published June 19, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.0th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-06-19T23:29Z
EPSS history
Timeline
  • 19 JUN 23:29Z
    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
    cvelistv5