A critical authentication bypass vulnerability in the Branda plugin for WordPress allows unauthenticated remote attackers to perform full account takeover.

This vulnerability is an authorization bypass (CWE-639) occurring because the plugin fails to validate user identity during the password update process. An unauthenticated attacker can exploit this flaw to reset the password of any user account on the affected WordPress site.

The ability for an unauthenticated attacker to reset the password of any user, including administrative accounts, represents a total compromise of the affected WordPress site. Given the CVSS score of 9.8, this vulnerability allows for complete data exfiltration, unauthorized administrative actions, and potential lateral movement within the hosting environment.

Immediate Action: Update the Branda plugin to the latest available version beyond 3.4.24 immediately to patch the authentication logic.

Proactive Monitoring: Review WordPress user account activity logs for suspicious password change events or unauthorized administrative logins.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting the login or password recovery endpoints of the Branda plugin.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The severity of this vulnerability cannot be overstated given that it requires no authentication to facilitate a full site takeover. Administrators should verify their current version of the Branda plugin and apply the vendor-supplied update immediately. If an immediate update is not feasible, consider deactivating the plugin until the patch can be safely applied to prevent unauthorized access.