CVE

CVE-2025-14998

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

branda – white label & branding, free login page customizer

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin References: https://nvd.nist.gov/vuln/detail/CVE-2025-14998 Remediation: Update to a version later than 3.4.24 or the latest available version.

Used 5 times · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: branda – white label & branding, free login page customizer

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →