The Branda plugin for WordPress contains a flaw that allows an attacker to change any user’s password without authentication. This lack of identity verification during password updates enables an unauthenticated attacker to take over administrative accounts, effectively gaining full control of the site. The vulnerability is a classic account‑takeover flaw, classified as CWE‑640.

WordPress sites using versions of the Branda – White Label & Branding, Free Login Page Customizer plugin up to and including 3.4.29 are potentially exposed. The issue is present in all earlier releases of the plugin where the password update path lacks proper user validation.

With a CVSS score of 9.8, the vulnerability is considered critical. Because the attack can be performed without authentication, the exploitation risk is high, although the EPSS score is not available. The lack of mitigation in the affected plugin versions means that any site with an old Branda plugin can be compromised easily if an attacker finds a way to reach the password update endpoint. The vulnerability is not listed in the CISA KEV catalog yet, but its severity and unauthenticated nature warrant immediate attention.