Not rated
CVE-2026-106015 Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
Description
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ecommerce Affiliate 1.0 | earliest → 1.0.0 | No fix stated |