CVE-2026-16300 Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2025-15672

The ChamaWP WordPress plugin (versions prior to 1.0.13 ) is vulnerable to unauthenticated PHP object injection due to improper validation of user input before it is passed to a PHP deserialization function . An attacker can exploit this to inject arbitrary PHP objects, potentially achieving remot...