CVE-2026-16300: ChamaWP Auth Bypass Vulnerability

CVE-2026-16300 Overview

CVE-2026-16300 is an authentication bypass vulnerability in the ChamaWP WordPress plugin. Versions before 1.0.13 fail to properly validate password reset requests. Unauthenticated attackers can reset the password of any user, including administrators. Successful exploitation leads to full site takeover.

The flaw is classified as Missing Authorization [CWE-862]. It is exploitable remotely over the network without user interaction or prior authentication. Site owners running ChamaWP should treat this as an urgent patching priority.

Critical Impact
Unauthenticated attackers can reset arbitrary user passwords, including administrator accounts, resulting in complete WordPress site compromise.

Affected Products

ChamaWP WordPress plugin, all versions prior to 1.0.13
WordPress installations with ChamaWP active
Administrator, editor, and subscriber accounts on affected sites

Discovery Timeline

2026-08-03 - CVE-2026-16300 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16300

Vulnerability Analysis

The ChamaWP plugin exposes a password reset workflow that does not adequately verify the identity of the requester or the integrity of reset parameters. An attacker submits a crafted password reset request targeting an arbitrary username or user ID. The plugin honors the request and sets a new password without validating ownership of the account.

Because the flaw resides in the reset logic itself, standard WordPress protections such as email-token verification are effectively bypassed. Attackers do not need valid credentials, an active session, or user interaction. The vulnerability is remotely exploitable against any internet-facing site running a vulnerable ChamaWP version.

Root Cause

The root cause is a missing authorization check [CWE-862] in the password reset handler. The plugin fails to bind the reset request to a validated token tied to the target account, and it does not verify that the requester is authorized to change the target user's credentials. This category of flaw is common in custom authentication workflows that reimplement functionality already handled securely by WordPress core.

Attack Vector

Exploitation occurs over HTTP or HTTPS against the vulnerable WordPress endpoint exposed by ChamaWP. An unauthenticated attacker crafts a request specifying a target account, typically the administrator, and supplies an attacker-chosen password. The plugin processes the request and updates the account credential. The attacker then logs in as the administrator and gains full control of the WordPress site, including plugin installation, content modification, and pivoting to the underlying host.

No verified proof-of-concept code is publicly available. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16300

Indicators of Compromise

Unexpected password reset events for administrator or privileged accounts in WordPress logs
Successful administrator logins from unfamiliar IP addresses or user agents shortly after reset requests
New administrator accounts, plugin installations, or theme edits following a suspicious reset event
HTTP requests to ChamaWP plugin endpoints from unauthenticated sources targeting reset functionality

Detection Strategies

Audit the wp_users and wp_usermeta tables for password hash changes that lack a matching legitimate reset email
Correlate web server access logs against ChamaWP endpoints to identify anomalous POST traffic from unauthenticated clients
Monitor WordPress activity logging plugins for user_password_reset events attributed to unknown sources

Monitoring Recommendations

Alert on any password change affecting an administrator account outside approved maintenance windows
Track failed and successful logins for privileged users and flag geographic or ASN anomalies
Enable file integrity monitoring on wp-config.php, theme files, and the mu-plugins directory to catch post-compromise persistence

How to Mitigate CVE-2026-16300

Immediate Actions Required

Update the ChamaWP plugin to version 1.0.13 or later on all WordPress installations
Force a password reset for all administrator and editor accounts after patching
Review recent administrator logins and audit for unauthorized configuration or plugin changes
Rotate WordPress secret keys defined in wp-config.php to invalidate any hijacked sessions

Patch Information

The vendor fixed this issue in ChamaWP 1.0.13. Site administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin directory with the patched release. Verify the installed version after upgrade by checking the Plugins page in wp-admin.

Workarounds

Deactivate and remove the ChamaWP plugin until the patched version can be installed
Restrict access to wp-login.php and plugin endpoints using a web application firewall or IP allowlist
Enable two-factor authentication on all administrator accounts to limit the impact of credential resets

bash

# Verify the installed ChamaWP version via WP-CLI
wp plugin get chamawp --field=version

# Update ChamaWP to the patched release
wp plugin update chamawp --version=1.0.13

# Force password reset for all administrators
wp user list --role=administrator --field=ID | \
  xargs -I {} wp user reset-password {}