CVE Intelligence
Analysis AI-assisted

CVE-2026-11551: Branda WordPress Plugin Account Takeover via Missing Identity Check on Password Update

CVE-2026-11551 affects the Branda WordPress plugin in all versions up to and including 3.4.29. The plugin does not properly verify a user's identity before updating a password, allowing unauthenticated attackers to change passwords of other users, including administrators. The record reports a CVSS 3.1 score of 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes a weakness in the Branda plugin for WordPress, whose package slug is branda-white-labeling. The plugin does not properly verify a user's identity before updating a password. The record classifies the issue as CWE-640, Weak Password Recovery Mechanism.

Impact

  • The record states that unauthenticated attackers can change the passwords of arbitrary users, including administrators.
  • After a password change, an attacker may be able to access the targeted account.
  • Wordfence assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products and versions

  • The record states that all versions up to and including 3.4.29 are affected.
  • The structured affected and fixes lists in the record are empty, so no fixed version is confirmed by the data.
  • A plugin trunk changeset is listed among the references, but the record does not state which release contains the corrected code.

Exploitation status

The CVE is not listed in the CISA KEV catalog according to the data consulted. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify all WordPress sites where Branda is installed and record the installed version.
  • Update Branda to a release newer than 3.4.29 as published by the plugin developer, and confirm the fix in the official plugin changelog or repository.
  • If an update cannot be applied immediately, consider deactivating the plugin until a fixed release is available, after assessing the operational impact.
  • After updating, review administrator accounts, password change history and active sessions for unexpected changes.

Detection guidance

  • Review web server and WordPress authentication logs for password changes that are not tied to a legitimate login or an administrative action.
  • Monitor for newly created or unexpectedly modified administrator accounts and for logins from unfamiliar sources shortly after password changes.
  • Correlate user record modifications with requests reaching the Branda plugin functionality.

Limitations of the available information

  • The record does not provide a fixed version, a list of affected products in structured form, or the exact vendor advisory text beyond the description.
  • The record does not state whether the issue requires any particular plugin configuration to be exploitable.
  • EPSS and SSVC data are not available in the record.
  • This analysis does not include technical exploitation details.

Frequently asked questions

What is the core problem in CVE-2026-11551?

According to the record, the Branda plugin does not properly verify a user's identity before updating a password. This allows unauthenticated attackers to change passwords of other users, including administrators.

Which versions are affected?

The record states that all versions up to and including 3.4.29 are affected. The record does not state which version contains the fix, so administrators should check the official plugin source for a newer release.

Is this vulnerability known to be exploited?

The CVE is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.