What is the CVSS score of EUVD-2026-52181?

EUVD-2026-52181 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ChamaWP are affected by EUVD-2026-52181?

Organizations running ChamaWP for WordPress face critical risk of complete site takeover through an unauthenticated account hijacking vulnerability in versions prior to 1.0.13.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52181?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52181. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-52181?

Within 24 hours, identify all WordPress installations running ChamaWP and determine their versions by inspecting the plugin directory and active plugin list; flag any instances running versions before 1.0.13 for immediate attention. Within 7 days, update all affected ChamaWP installations to version 1.0.13 or later using the WordPress plugin update mechanism. Within 30 days, conduct a full audit of administrator account activity logs for any suspicious access during the vulnerability window, reset all administrator passwords as a precautionary measure, review administrative account permissions to ensure no unauthorized privilege escalation has occurred, and implement ongoing monitoring for unusual administrative activities.

ChamaWP EUVD-2026-52181

| CVE-2026-16300 CRITICAL

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-6m7v-g5wq-gghp

WordPress Authentication Bypass Chamawp

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote reset of arbitrary admin passwords requires no privileges, complexity, or interaction (AV:N/AC:L/PR:N/UI:N) and yields full account control (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 17:25 vuln.today

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Articles & Coverage 1

News Critical Authentication Bypass in WordPress ChamaWP Plugin - CVE-2026-16300 Aug 03, 2026

AnalysisAI

Account takeover in the ChamaWP WordPress plugin before 1.0.13 lets unauthenticated attackers reset the password of any user, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password-reset request (CWE-862, missing authorization). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Identify site running ChamaWP

Delivery

Send crafted password-reset request for admin

Exploit

Bypass reset validation (CWE-862)

Install

Set attacker-controlled admin password

Execute

Upload malicious plugin/webshell

Impact

Full site takeover

Recon

Identify site running ChamaWP

Delivery

Send crafted password-reset request for admin

Exploit

Bypass reset validation (CWE-862)

Install

Set attacker-controlled admin password

Execute

Upload malicious plugin/webshell

Impact

Full site takeover

Vulnerability AssessmentAI

Exploitation	The target site must have the ChamaWP plugin installed and activated at a version below 1.0.13 and expose its password-reset functionality. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed but lean toward genuine priority for anyone running the plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted password-reset request to a WordPress site running a vulnerable ChamaWP version, targeting the administrator account. Because the plugin does not properly validate the request, the attacker sets a new password of their choosing and logs in as administrator, then installs a malicious plugin or webshell for persistent control. …
Remediation	Vendor-released patch: upgrade the ChamaWP plugin to version 1.0.13 or later, which corrects the password-reset validation. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all WordPress installations running ChamaWP and determine their versions by inspecting the plugin directory and active plugin list; flag any instances running versions before 1.0.13 for immediate attention. …

Threat intelligence, references, and detailed analysis are available after sign-in.