Non notée
CVE-2026-106015 Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
Description
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ecommerce Affiliate 1.0 | premières → 1.0.0 | Pas de correctif indiqué |