VulnSocial

CVE-2026-11551Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 3 mentions (2026-06-20); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01223Mentions · 2026-06-19: 1Mentions · 2026-06-20: 3Mentions · 2026-06-22: 1Mentions · 2026-06-26: 1Patch / Workaround · 2026-06-20: 1Patch / Workaround · 2026-06-22: 1Patch / Workaround · 2026-06-26: 1Technical Details · 2026-06-20: 3Technical Details · 2026-06-22: 1Technical Details · 2026-06-26: 106-1906-2006-2206-26
Signal classification3 categories
Disclosure
350.0%
Patch
233.3%
General
116.7%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-191
General1
2026-06-203
Disclosure2Patch1
2026-06-221
Disclosure1
2026-06-261
Patch1
Full discourse6 posts
  • SecAlerts@SecAlertsCo
    Patch

    🏷️ WordPress Branda plugin (<=3.4.29) has a critical 9.8 flaw. Unauthenticated attackers can take over accounts and escalate privileges - no login needed. CVE-2026-11551. Update now. #WordPress #cybersecurity https://secalerts.co/vulnerability/CVE-2026-11551?utm_campaign=x https://t.co/mcINIXDynJ

    Post summary

    The post announces a critical (CVSS 9.8) vulnerability in WordPress Branda plugin that allows unauthenticated privilege escalation, and urges administrators to apply the latest update to mitigate the risk.

    0000176
    846 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-11551 - Critical privilege escalation in #Branda #WordPress plugin. Unauthenticated account takeover via improper password reset validation. #CVSS 9.8. No patch available. Disable immediately. #cvealert #infosec #sysadmin #DevSecOps #devops #developers More info 1/2

    Post summary

    The tweet announces a critical privilege‑escalation vulnerability (CVE‑2026‑11551) in the Branda WordPress plugin, noting lack of a patch and recommending disabling the plugin.

    1000067
    959 followersView on X
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-11551 — CVSS 9.8/10 ██████████ The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/4uEx8s76iZ

    Post summary

    The tweet announces CVE-2026-11551, a critical privilege‑escalation flaw in the Branda WordPress plugin, and urges users to apply the available patch.

    10000315
    59 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-11551 The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not… https://www.cve.org/CVERecord?id=CVE-2026-11551

    Post summary

    The text announces that the Branda WordPress plugin is vulnerable to privilege escalation through account takeover for all versions up to 3.4.29.

    00010330
    57.7K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-11551 The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not… https://www.cve.org/CVERecord?id=CVE-2026-11551 ----- Traducción: CVE-2026-11551 El … http://infoflow.cloud`

    Post summary

    The post reports CVE‑2026‑11551, highlighting a privilege‑escalation flaw in the Branda WordPress plugin up to version 3.4.29, without mentioning exploits, patches, or active exploitation.

    0000038
    88 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-11551 2026-11551 CVE-2026-11551 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11551

    Post summary

    The snippet merely lists a CVE number and links to a vulnerability database page without providing additional context or details.

    0000037
    4.1K followersView on X

Explore more

Back to dashboard