Branda’s Signup Password feature hooked the random_password filter and returned the request’s password_1 value, so every random value WordPress generated during that request, including a lost-password reset key, became attacker-chosen. Unauthenticated attackers can request a password reset for any account, including administrators, use the known reset key to set a new password, and take the account over. Sites are affected when the Login Screen module’s Signup Password option is enabled.
This vulnerability affects the following application versions:
- Branda 3.3.1
- Branda 3.3.2
- Branda 3.4.0
- Branda 3.4.1
- Branda 3.4.3
- Branda 3.4.4
- Branda 3.4.5
- Branda 3.4.5.1
- Branda 3.4.6
- Branda 3.4.7
- Branda 3.4.8
- Branda 3.4.8.1
- Branda 3.4.9
- Branda 3.4.9.1
- Branda 3.4.9.3
- Branda 3.4.10
- Branda 3.4.11
- Branda 3.4.13
- Branda 3.4.14
- Branda 3.4.15
- Branda 3.4.16
- Branda 3.4.17
- Branda 3.4.18
- Branda 3.4.19
- Branda 3.4.21
- Branda 3.4.22
- Branda 3.4.23
- Branda 3.4.24
- Branda 3.4.25
- Branda 3.4.26
- Branda 3.4.27
- Branda 3.4.28