The ChamaWP WordPress plugin before version 1.0.13 does not properly validate password reset requests, resulting in a missing authorization vulnerability (CWE-862). This allows unauthenticated attackers to reset passwords for any user account, including those with administrative privileges, potentially leading to complete control over the affected WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation enables an attacker with no authentication to reset passwords of arbitrary users, including administrators. This can lead to full site compromise, allowing the attacker to control the WordPress site, modify content, and potentially deploy further malicious actions.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, consider restricting access to password reset functionality or implementing additional access controls as a temporary mitigation.