CVE-2024-6554: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizi

medium Affects branda-white-labeling (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-07-11; advisory modified 2026-06-17.

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizi

Package: branda-white-labeling (WordPress plugin) WordPress
Affected versions: <3.4.19
Fixed in: 3.4.19
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 0% (39.2th percentile)
Published: 2024-07-11
Source: nvd

References

CWE-200

NVD record branda-white-labeling (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-5191 medium The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is v same package: branda-white-labeling (WordPress plugin)
CVE-2017-5487 medium wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implemen same weakness: CWE-200
CVE-2018-7251 critical Anchor CMS Logs Credentials same weakness: CWE-200
CVE-2021-39327 medium The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosur same weakness: CWE-200
CVE-2009-0815 medium TYPO3 leaks a hash secret in an error message same weakness: CWE-200
CVE-2014-2383 medium DOMPDF Arbitrary File Read same weakness: CWE-200