CVE-2026-11551

Deferred Deferred - Pending Action

Privilege Escalation via Account Takeover in Branda WordPress Plugin

Publication date: 2026-06-20

Last updated on: 2026-06-23

Assigner: Wordfence

Description

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-20

Last Modified

2026-06-23

Generated

2026-07-10

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-09

NVD

CVE-2026-11551

EUVD

EUVD-2026-38097

Affected Vendors & Products

Vendor	Product	Version / Range
branda	plugin	to 3.4.29 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

The Branda plugin for WordPress has a vulnerability that allows privilege escalation through account takeover. This happens because the plugin does not properly verify a user's identity before allowing a password update. As a result, an unauthenticated attacker can change the password of any user, including administrators, and gain access to their accounts.

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to take over user accounts without authentication. Attackers can change passwords of any user, including administrators, which can lead to unauthorized access, data breaches, and full control over the affected WordPress site.

Mitigation Strategies

To mitigate this vulnerability, you should immediately update the Branda plugin for WordPress to a version later than 3.4.29 where the issue is fixed.

Additionally, review and reset passwords for all user accounts, especially administrator accounts, to prevent unauthorized access due to potential password changes by attackers.

Ensure that your WordPress installation and all plugins are kept up to date to avoid similar privilege escalation vulnerabilities.

Hi! I’m here to help you understand CVE-2026-11551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70