CVE-2026-106015
Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
What each source reports
CVE List No score
Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
- Record
CVE-2026-106015- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-xxh9-x8mr-vqr4 No score
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password...
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
- Record
GHSA-xxh9-x8mr-vqr4- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-106015 is a vulnerability with no CVSS score yet in Unknown Ecommerce Affiliate, published November 8, 2026. No source lists public exploit code. No source names a fixed version.