CVE-2026-16300

The CVE affects the ChamaWP WordPress plugin, all versions before 1.0.13. Root cause: password reset requests are not properly validated, allowing unauthenticated attackers to reset any user password (including admins) and potentially take over the site. The provided records do not specify an off...

EUVD-2025-210596

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...