Branda WordPress Plugin Unauthenticated Privilege Escalation via Account Takeover

Repository contains a single Python exploit script and a minimal README. The main file, cve_2026_11551.py, is an operational exploit for CVE-2026-11551 affecting the WordPress Branda White Label & Branding plugin <= 3.4.29. The script targets a logic flaw in Branda’s signup password handling where password_1 can overwrite the password of an existing user because the hook runs on all wp_insert_user/wp_update_user calls without properly excluding updates. The exploit supports two paths: single-site WordPress registration through /wp-login.php?action=register and multisite signup/activation through /wp-signup.php followed by /wp-activate.php. It performs reconnaissance to identify plugin presence/version, determine whether the site is multisite, check whether registration is open, and assess whether Branda password fields are present. It generates attacker-controlled passwords and unique email addresses, attempts takeover against supplied or default usernames, supports optional proxying and SSL verification disablement, and can run against a single target or mass-scan a list with threading. Successful takeovers are written to branda_results.txt along with metadata and cookies. Overall, this is a real exploit rather than a detector, and its purpose is unauthenticated privilege escalation via account takeover of existing WordPress users.