📰 INDUSTRY NEWS

🚨 WordPress Plugin Branda: Admin Takeover Without Authentication

CVE-2025-14998 just dropped. CVSS score: 9.8 (CRITICAL)

The Branda white-label plugin (10,000+ active installs) allows anyone to reset admin passwords without authentication.

Attack flow:
→ Send crafted request
→ Change admin password
→ Log in as admin
→ Full site compromise

Affected: All versions ≤ 3.4.24
Patched: Version 3.4.25 (January 2, 2026)

Who uses Branda?
→ WordPress agencies
→ White-label developers
→ Multi-site managers

One compromised client site = entry point to entire portfolio.

Update immediately. Check user accounts for suspicious additions. Regenerate WordPress salts.

This is the 4th critical (9.8+) WordPress plugin vulnerability in January alone.

Pattern is clear.

Stay tuned! 🤓

#WordPress #Security #CVE #Branda #WebHostMost