CVE-2026-106015
Received Received - Intake

Unauthenticated Account Takeover in Ecommerce Affiliate WordPress Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: WPScan

Description
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-106015
EUVD
EUVD-2026-119475

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Ecommerce Affiliate From 0 (inc) to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Ecommerce Affiliate WordPress plugin through version 1.0.0 has a flaw where one-time passwords (OTPs) for account verification are not restricted to the legitimate owner. Attackers can exploit this by brute-forcing OTP codes without authentication, allowing them to take over any account, including administrator accounts.

Detection Guidance

Check if the Ecommerce Affiliate WordPress plugin version 1.0.0 or below is installed. Look for signs of unauthorized account access or repeated OTP verification attempts in logs.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain full control over any account on the affected WordPress site, including admin accounts. Attackers can steal sensitive data, modify site content, or perform malicious actions without detection.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Disable the Ecommerce Affiliate plugin immediately if installed. Monitor accounts for suspicious activity. Apply any official updates once released. Consider implementing rate limiting for OTP requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...