CVE-2026-16300

The CVE affects the ChamaWP WordPress plugin, all versions before 1.0.13. Root cause: password reset requests are not properly validated, allowing unauthenticated attackers to reset any user password (including admins) and potentially take over the site. The provided records do not specify an off...