EUVD-2026-38097
GHSA-r464-rgh8-qf85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote HTTP endpoint, no auth or interaction, and trivial request flips any account's password - yielding full confidentiality, integrity, and availability impact on the WordPress site.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
AnalysisAI
Unauthenticated account takeover in the Branda (white-labeling) plugin for WordPress through version 3.4.29 allows remote attackers to reset arbitrary user passwords, including administrators, by abusing a password update flow that fails to verify the requester's identity. Wordfence-reported flaw is tracked as CVE-2026-11551 with a CVSS 9.8; no public exploit identified at time of analysis, but the trivial exploitability of the vulnerable signup-password module makes weaponization straightforward once the patched code is diffed.
Technical ContextAI
Branda (formerly Ultimate Branding) is a WPMU DEV white-labeling plugin used to customize the WordPress login, admin, and signup experience. The defect lives in inc/modules/login-screen/signup-password.php around line 232, which handles password updates from the customized signup/login screens. The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password): the handler updates the target user's password without verifying that the requester actually owns the account - there is no valid nonce/token tied to the user, no current-password check, and no authenticated session bound to the target user_id. The plugins.trac changeset 3568291 against trunk/inc/modules/login-screen/signup-password.php is the upstream fix that adds the missing identity validation.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the wordpress.org plugin trac changeset 3568291 (https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php) corrects the signup-password handler, so administrators should update Branda to the first release that incorporates that changeset (any version strictly greater than 3.4.29) as soon as it is published on wordpress.org and confirmed via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091. Until that release is installed, deactivate the Branda plugin or, if branding must remain active, disable the login-screen / signup-password module specifically (this removes the custom signup flow but preserves admin/login white-labeling), and block public POST access to the signup-password endpoint at a WAF or via web-server rules - note this will break legitimate self-service password setup for new signups. As a hardening step, force a password reset for all existing users (especially administrators) and review recent password-change events in audit logs, since silent resets pre-patch would not surface in normal authentication logs.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today