PT-2026-51041 · WordPress · Branda
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Branda plugin for WordPress versions prior to 3.4.30
Description
The plugin is susceptible to privilege escalation through account takeover. This occurs because the software fails to properly validate a user's identity before updating a password, allowing unauthenticated attackers to change the passwords of arbitrary users, including administrators, to gain unauthorized account access.
Recommendations
Update the plugin to a version later than 3.4.29.
Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Branda