Skip to content
Sign in
9.8 Critical

CVE-2026-16300 The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing…

Description

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Affected products and versions

Product Affected versions Fixed in
ChamaWP 1.0 earliest → < 1.0.13 1.0.13

Other CVEs of ChamaWP

The 2 CVEs of ChamaWP →
CVE-2025-15672 The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP… 8.1 High
Track this CVE