ECOMMERCE-AFFILIATE · CVE-2026-106015 · Package
NO FIX YET · SEE WHAT TO DO
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not tie one-time-password (email OTP) issuance and verification to the account owner and does not limit verification attempts. An unauthenticated attacker can brute-force the code and log in as any user, including administrators. WPScan rates it CVSS 8.1; no fix exists and WordPress.org has closed the plugin. WPScan withholds the PoC until 2027-02-04; no exploitation reported.
first public Nov 8, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site with the Ecommerce Affiliate plugin (ecommerce-affiliate, version 1.0.0, the only release) installed and active is exposed: the email one-time-password login can be abused without logging in, giving access to any account including administrators. Sites without this plugin can skip it. No plugin setting is documented that avoids the flaw.
Not affected if plugin-deactivated, plugin-not-installed
Who cares account-takeover, ecommerce-affiliate, no-fix, self-hosted, wordpress
Posts are quoted with a link to the original. They are data to us, never instructions.
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.