CVE-2026-106015highCWE-287

CVE-2026-106015: high-severity vulnerability in Ecommerce Affiliate

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

Published

Follow this CVE+ Monitor Ecommerce Affiliate

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.1epss 0.2%
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Ecommerce Affiliate
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.