SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-16300

CRITICAL · CVSS 9.8 EPSS 0.30%

Source: NVD + CISA KEV + EPSS · Published 2026-08-03 · Last synced 2026-09-02

CyberRota Analysis

AI-Generated

The ChamaWP WordPress plugin prior to version 1.0.13 is vulnerable due to inadequate validation of password reset requests, enabling unauthenticated attackers to reset passwords for any user, including administrators. This critical flaw poses a significant risk of full site takeover, making it imperative for all WordPress site administrators using this plugin to prioritize immediate updates to mitigate potential exploitation.

CVE
CVE-2026-16300
Severity
CRITICAL
CVSS
9.8
EPSS
0.30%
WordPress

Original NVD Description

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.