CVE-2026-16300

CriticalCVSS 9.8

Published: 03/08/2026(UTC)Updated: 03/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The 'ChamaWP' WordPress plugin before version 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Risk Assessment

An attacker can take over the site by resetting the administrator's password and logging into their account.

Recommendation

Update the plugin to version 1.0.13 or later, which properly validates password reset requests.

Original NVD description (English source)

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.