Is CVE-2026-11551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11551 being exploited in the wild.

How severe is CVE-2026-11551?

Critical severity, with a CVSS score of 9.8, published 20 June 2026.

Which products and versions are affected?

WPMU DEV Branda up to and including 3.4.29.

Is there a fix for CVE-2026-11551?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11551 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11551?

Check whether you run WPMU DEV Branda at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11551: WPMU DEV Branda privilege escalation via account takeover

CVE-2026-11551 · Severity: critical · CVSS 9.8 · Published 2026-06-20

The Branda plugin for WordPress, used for white-labeling and customizing login screens, contains a critical security flaw that allows unauthorized individuals to take over user accounts. By exploiting a weakness in how the plugin handles password updates, an attacker can change the password of any user, including site administrators. This could lead to a total loss of control over the website, data theft, or the installation of malicious software.

Vendors: WPMU DEV.

Quick answers

Is CVE-2026-11551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11551 being exploited in the wild.
How severe is CVE-2026-11551?: Critical severity, with a CVSS score of 9.8, published 20 June 2026.
Which products and versions are affected?: WPMU DEV Branda up to and including 3.4.29.
Is there a fix for CVE-2026-11551?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11551 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11551?: Check whether you run WPMU DEV Branda at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Branda plugin for WordPress (versions up to 3.4.29) is vulnerable to an unauthenticated account takeover due to a weak password recovery mechanism (CWE-640). The root cause is located in the signup-password.php component, where the plugin fails to properly validate a user's identity or verify a secure token before allowing a password update. An unauthenticated remote attacker can exploit this by sending a crafted request to change the password of any arbitrary user, including those with administrative privileges. This leads to full site compromise. A patch has been released in the plugin's trunk (changeset 3568291).

Affected products

WPMU DEV Branda – White Label & Branding, Free Login Page Customizer up to and including 3.4.29

Timeline

2026-06-19: disclosed: Vulnerability reported by Wordfence
2026-06-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.