CVE-2025-14998
CRITICAL EXPLOITEDBranda WordPress <3.4.24 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2025-14998 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including KTN1990.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated privilege escalation vulnerability in the WordPress Branda plugin (versions up to 3.4.24) by exploiting improper password validation, allowing attackers to reset any user's password, including administrators.
Description
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Exploits (1)
This PoC demonstrates an unauthenticated privilege escalation vulnerability in the WordPress Branda plugin (versions up to 3.4.24) by exploiting improper password validation, allowing attackers to reset any user's password, including administrators.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H