CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-11551 — The Branda plugin for WordPress is vulnerable to privilege escalation via accoun...

·Source: NIST NVD

Updated:

Executive Summary

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their ac

Analysis

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. CVSS Score: 9.8. Published: 2026-06-20T00:16:15.580.

Indicators of Compromise (1)

CVE (1)
CVE-2026-11551
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 20, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-58289 — Access of resource using incompatible type ('type confusion') in Microsoft Edge ...

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-58289
NIST NVD
MEDIUMVulnerability

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library that lets a device read and write the FAT and exFAT formats used on USB drives and SD cards. The flaws matter because FatFs is nearly everywhere. It ships inside the firmware that runs security cameras, drones, industrial controllers, hardware crypto wallets, and other devices built on

The Hacker News
MEDIUMVulnerability

NetNut proxy network disrupted, 2 million infected devices cut off

A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes. [...]

BleepingComputer