CVE-2026-16300 — Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset

CVE-2026-16300

Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset PUBLISHED

Description (CNA)

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Affected (CNA)

Vendor / product	Versions
Unknown / ChamaWP	affected 0 before 1.0.13

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0508f8c8-8ecc-4982-b14c-bf5f1c3d1c8f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.