External risk intelligence

ChamaWP WordPress Plugin Password Reset Vulnerability Allows Site Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16300

The vulnerability affects a WordPress plugin, a type of software designed to extend the functionality of public-facing web servers. Password reset functionality is a standard, internet-accessible feature of web applications, making this surface reachable by design in normal deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin that could allow unauthorized individuals to reset user passwords, including administrator accounts. This could potentially lead to unauthorized control of your website. The main concern at this time is to confirm if this plugin is in use and assess potential exposure.

Attackers can reset any user password.
It impacts website security and access control.
Confirm plugin use and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker can target a website using the ChamaWP WordPress plugin by exploiting a flaw in its password reset mechanism. This allows them to reset the password for any user, including administrators, without needing any prior authentication. Successful exploitation could result in complete control over the website.

No authentication required.
Reset any user's password.
Complete website takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the ChamaWP WordPress plugin could allow an attacker to take over a website. If an attacker sends a specially crafted password reset request, they could change the password for any user account, including administrator accounts, when the plugin is in use and the reset functionality is accessible. This could lead to a complete compromise of the website's control.

Website administrative access.
Unauthenticated password reset requests.
Full website takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are most likely responsible for addressing this critical vulnerability in the ChamaWP WordPress plugin. The first step is to identify all instances of this plugin across your WordPress sites, determine their reachability and business criticality, and then confirm the accountable owner for each instance to plan remediation.

WordPress application owners should own the issue.
Verify plugin presence and network exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ChamaWP plugin used for?

ChamaWP is a WordPress plugin designed to extend the functionality of a WordPress site. WordPress plugins are modular add-ons that web administrators install to introduce specific features, such as enhanced user management or custom tools, directly into their website's existing framework.

What does CWE-862 mean for CVE-2026-16300?

CWE-862 refers to Missing Authorization. In the context of this vulnerability, it means the plugin fails to verify whether a user has the right to perform a password reset. Because this check is missing, the system assumes the request is valid, allowing an unauthorized person to change any user's password.

How does an attacker trigger this password reset flaw?

An attacker triggers this by sending a specially crafted request to the plugin's password reset function. Because the software lacks the necessary authorization checks, it processes the request automatically. Simply interacting with the site's standard login page for legitimate activities does not trigger the vulnerability; it requires this specific, malicious request format.

Is my website at risk if it uses this plugin?

Halo Surface Signal indicates this vulnerability is very likely to be reachable because password reset features are designed to be accessible over the internet. If your WordPress site is public-facing and uses a vulnerable version of ChamaWP, the login mechanism is exposed to these unauthorized requests, making the risk of account compromise significant.

How should I respond if I use ChamaWP?

Your first step is to perform an inventory of all WordPress sites to identify every instance where ChamaWP is installed. Once you have a list, check the plugin version; versions before 1.0.13 are affected. Coordinate with your team to prioritize these sites, especially those with high business criticality or administrative access, to ensure they are updated to a secure version.

References

wpscan.com/vulnerability/0508f8c8-8ecc-4982-b14c-bf5f1c3d1c8f/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.