# CVE-2026-11551: WPMU DEV Branda privilege escalation via account takeover

Source: https://junglewise.ai/threats/cve-2026-11551-wpmu-dev-branda-privilege-escalation-via-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-11551 · Severity: critical · CVSS 9.8 · Published 2026-06-20

The Branda plugin for WordPress, used for white-labeling and customizing login screens, contains a critical security flaw that allows unauthorized individuals to take over user accounts. By exploiting a weakness in how the plugin handles password updates, an attacker can change the password of any user, including site administrators. This could lead to a total loss of control over the website, data theft, or the installation of malicious software.

Vendors: [WPMU DEV](https://junglewise.ai/threats/vendors/wpmu-dev).

## Quick answers

**Is CVE-2026-11551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11551 being exploited in the wild.

**How severe is CVE-2026-11551?** Critical severity, with a CVSS score of 9.8, published 20 June 2026.

**Which products and versions are affected?** WPMU DEV Branda up to and including 3.4.29.

**Is there a fix for CVE-2026-11551?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11551 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11551?** Check whether you run WPMU DEV Branda at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Branda plugin for WordPress (versions up to 3.4.29) is vulnerable to an unauthenticated account takeover due to a weak password recovery mechanism (CWE-640). The root cause is located in the signup-password.php component, where the plugin fails to properly validate a user's identity or verify a secure token before allowing a password update. An unauthenticated remote attacker can exploit this by sending a crafted request to change the password of any arbitrary user, including those with administrative privileges. This leads to full site compromise. A patch has been released in the plugin's trunk (changeset 3568291).

## Affected products

- WPMU DEV Branda – White Label & Branding, Free Login Page Customizer up to and including 3.4.29

## Timeline

- 2026-06-19: disclosed: Vulnerability reported by Wordfence
- 2026-06-20: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.29/inc/modules/login-screen/signup-password.php](https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.29/inc/modules/login-screen/signup-password.php)
- [https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php](https://plugins.trac.wordpress.org/changeset/3568291/branda-white-labeling/trunk/inc/modules/login-screen/signup-password.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=cve)

## Related threats

- [Branda white-labeling plugin stored XSS](https://junglewise.ai/threats/cve-2026-102376-subscriber-cross-site-scripting-xss-in-branda-3-4-32-versions)