Branda WordPress Plugin Privilege Escalation Vulnerability via Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the Branda plugin for WordPress, affecting all versions through 3.4.24. The issue arises because the plugin fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover, particularly of administrator accounts.

Remediation

Users are advised to update the Branda WordPress plugin to version 3.4.29 or a newer patched version.