CVE-2026-11551: Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

Synopsis

This is an authentication bypass and privilege escalation vulnerability in the Branda (White Label and Branding) plugin for WordPress, affecting all versions up to and including 3.4.29. It is reachable over the network with no authentication required and no user interaction needed, meaning any remote attacker can trigger it directly against an exposed WordPress site. Successful exploitation allows an attacker to reset any user's password, including administrator accounts, take over those accounts, and gain full control of the WordPress installation. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or credentials of any kind are needed; the attack can be executed by a completely anonymous remote attacker.

• Victim interactionNot required

  The attacker does not need any user to click a link or take any action; the password reset can be triggered entirely server-side.

• Attack complexityDetail

  Exploit reliability is high and no special conditions, race conditions, or environmental factors are required to succeed.

Blast Radius

• Attacker resets the password of any WordPress user, including site administrators, and logs in with full account privileges.
• Attacker reads all stored site content, user records, session tokens, and any sensitive data accessible to the hijacked account.
• Attacker modifies or deletes posts, pages, plugin settings, and site configuration, including installing or activating arbitrary plugins.
• Attacker can fully compromise the WordPress host environment if the administrator account has sufficient server-level access.