How to: CVE-2025-14998 (2026-01-02)
```
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
```
- [KTN1990/CVE-2025-14998](https://github.com/KTN1990/CVE-2025-14998)