CVE-2026-16300
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset
CVSS Score
9.8
EPSS Score
0.1%
EPSS Percentile
5th
The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
| Vendor | unknown |
| Product | chamawp |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown chamawp
Be the first to know when new critical vulnerabilities affecting unknown chamawp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ChamaWP
0 < 1.0.13
References
Credits
moonge WPScan