The ChamaWP WordPress plugin versions before 1.0.13 contains a critical vulnerability in its password reset functionality. The plugin fails to properly validate password reset requests, allowing unauthenticated attackers to reset passwords for arbitrary users. This includes administrator accounts, making the flaw particularly severe. Successful exploitation could lead to a complete site takeover. No authentication is required to exploit this vulnerability. The issue has been addressed in version 1.0.13 of the plugin. WordPress site administrators using affected versions should update immediately to mitigate risk.