Vulnerability · Published Aug 3, 2026 · Assigned by WPScan

CVE-2026-16300Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset

Critical 9.8

In plain English

A critical-severity missing authorization in ChamaWP from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Affected products (as reported)

Vendor	Product	Versions
Unknown	ChamaWP	0 – before 1.0.13

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/0508f8c8-8ecc-4982-b14c-bf5f1c3d1c8f/ exploit, vdb-entry, technical-description