What is the CVSS score of EUVD-2026-52181?

EUVD-2026-52181 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ChamaWP are affected by EUVD-2026-52181?

Organizations running ChamaWP for WordPress face critical risk of complete site takeover through an unauthenticated account hijacking vulnerability in versions prior to 1.0.13.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52181?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52181. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-52181?

Within 24 hours, identify all WordPress installations running ChamaWP and determine their versions by inspecting the plugin directory and active plugin list; flag any instances running versions before 1.0.13 for immediate attention. Within 7 days, update all affected ChamaWP installations to version 1.0.13 or later using the WordPress plugin update mechanism. Within 30 days, conduct a full audit of administrator account activity logs for any suspicious access during the vulnerability window, reset all administrator passwords as a precautionary measure, review administrative account permissions to ensure no unauthorized privilege escalation has occurred, and implement ongoing monitoring for unusual administrative activities.

ChamaWP EUVD-2026-52181

| CVE-2026-16300 CRITICAL

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-6m7v-g5wq-gghp

WordPress Authentication Bypass Chamawp Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote reset of arbitrary admin passwords requires no privileges, complexity, or interaction (AV:N/AC:L/PR:N/UI:N) and yields full account control (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 17:25 vuln.today

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Articles & Coverage 1

News Critical Authentication Bypass in WordPress ChamaWP Plugin - CVE-2026-16300 Aug 03, 2026

AnalysisAI

Account takeover in the ChamaWP WordPress plugin before 1.0.13 lets unauthenticated attackers reset the password of any user, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password-reset request (CWE-862, missing authorization). Publicly available exploit code exists, though EPSS remains low (0.15%) and it is not listed in CISA KEV - no public in-the-wild exploitation confirmed at time of analysis.

Technical ContextAI

ChamaWP is a WordPress plugin (chamas/savings-group management) running within the PHP-based WordPress ecosystem. The vulnerability is classed as CWE-862 (Missing Authorization): the plugin exposes a password-reset workflow that fails to properly validate the legitimacy/ownership of the reset request, so the authorization check that should tie a reset token to the requesting user is missing or bypassable. Because WordPress password resets ultimately set the wp_users credential hash, an attacker who can drive this flow for an arbitrary account (including the administrator, user ID 1) inherits full control of that account. The CPE cpe:2.3:a:unknown:chamawp:*:*:*:*:*:*:*:* confirms the affected component is the ChamaWP application plugin across all published versions below the fix.

RemediationAI

Vendor-released patch: upgrade the ChamaWP plugin to version 1.0.13 or later, which corrects the password-reset validation. Administrators should update immediately via the WordPress plugin dashboard and verify no unauthorized administrator password changes or new admin accounts were created prior to patching. If an immediate update is not possible, the strongest compensating control is to deactivate/remove the ChamaWP plugin until it can be updated (side effect: loss of chama/savings-group functionality it provides); alternatively, restrict access to the plugin's password-reset endpoint at the web server or WAF layer and monitor authentication logs for unexpected reset activity (side effect: may block legitimate resets and requires knowing the exact endpoint). After patching, force a password reset for all privileged accounts as a precaution. See the WPScan advisory (https://wpscan.com/vulnerability/0508f8c8-8ecc-4982-b14c-bf5f1c3d1c8f/) for details.