CVE-2026-11551: Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Branda – White Label & Branding, Free Login Page Customizerfrom your environment.If the plugin is not required, uninstall the Branda plugin from affected sites to eliminate the vulnerability.
- Configuration
Deactivate the Branda plugin on affected WordPress sites until a security fix is available.
Branda – White Label & Branding, Free Login Page Customizer plugin_active = false - Compensating control
Restrict access to the WordPress admin interface and password-reset endpoints using network controls (firewall, WAF, or IP allowlists) to trusted IPs to reduce exposure until the plugin is fixed.
- Operational
Force a password reset for all administrative and high-privilege accounts and rotate any credentials that may have been changed or exposed. Review authentication and change-history logs for signs of unauthorized account changes or access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11551?
The severity of CVE-2026-11551 is critical, with a CVSS score of 9.8.
What does CVE-2026-11551 allow an attacker to do?
CVE-2026-11551 allows unauthenticated attackers to escalate privileges via account takeover by improperly validating user identity.
How can I mitigate CVE-2026-11551?
To mitigate CVE-2026-11551, it is recommended to update the Branda plugin to the latest version beyond 3.4.29.
What software is affected by CVE-2026-11551?
CVE-2026-11551 affects the Branda plugin for WordPress in all versions up to and including 3.4.29.
Is authentication required for CVE-2026-11551 exploitation?
No authentication is required for exploitation of CVE-2026-11551, making it particularly dangerous.