/Vulnerability Library

Branda WordPress plugin - Privilege Escalation

CVE-2025-14998
Verified

Description

Branda WordPress plugin <= 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request.

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Published Date

August 24, 2026

Template Author

theamanrawat

CVE-2025-14998.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-14998
CWE ID:
cwe-639

References

https://nvd.nist.gov/vuln/detail/CVE-2025-14998

Remediation Steps

Update to a version later than 3.4.24 or the latest available version.