CVE-2025-14998
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Analysis
The Branda WordPress plugin (through 3.4.24) allows unauthenticated attackers to reset any user's password without identity verification, enabling account takeover including administrator accounts. Full site compromise is one password reset away.
Technical Context
The password reset functionality does not properly verify the requester's identity before changing the password (CWE-639 – Authorization Bypass Through User-Controlled Key). An attacker can specify any user's identifier and set a new password without possessing the original credentials or email verification token.
Affected Products
Branda WordPress plugin through 3.4.24
Remediation
Update Branda to a patched version immediately. Check for unauthorized admin logins. Reset all user passwords if exploitation is suspected. Implement MFA for admin accounts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today