{"id":"CVE-2026-106015","kind":"vulnerability","aliases":["CVE-2026-106015"],"related":[],"title":"Ecommerce Affiliate WordPress plugin (<= 1.0.0) lets anyone take over any account by guessing email login codes","description":"The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.","summary":"The Ecommerce Affiliate WordPress plugin through 1.0.0 does not tie one-time-password (email OTP) issuance and verification to the account owner and does not limit verification attempts. An unauthenticated attacker can brute-force the code and log in as any user, including administrators. WPScan rates it CVSS 8.1; no fix exists and WordPress.org has closed the plugin. WPScan withholds the PoC until 2027-02-04; no exploitation reported.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ecommerce-affiliate","fixed":[],"affected":"<= 1.0.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["account-takeover","ecommerce-affiliate","no-fix","package","self-hosted","wordpress"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- In WordPress admin under Plugins, or in wp-content/plugins/ecommerce-affiliate/, check whether Ecommerce Affiliate (slug ecommerce-affiliate, by ITclan BD) is installed; any version up to 1.0.0 (the only release) is affected.\n- Review recent logins, new administrator accounts and repeated OTP requests in access logs.","fix":"No fixed version. WordPress.org closed the plugin on 2026-10-23 (temporary, pending review) and it cannot be downloaded; WPScan lists no known fix. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:21+00:00","updated_at":"2026-11-08T06:48:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-08T06:47:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ecommerce Affiliate WordPress plugin lets attackers take over any account","impact":"high","summary":"The Ecommerce Affiliate WordPress plugin through 1.0.0 issues and checks one-time passwords without restricting them to the account owner or limiting guess attempts. An unauthenticated attacker can log in as any user, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ecommerce-affiliate","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any user, including administrators, and takes over the site","analyst_note":"Find the vendor or plugin repository advisory for the fixed version and any setting or removal guidance; NVD text alone gives no fix.","how_to_check":"- Check whether the Ecommerce Affiliate plugin is installed and its version is `1.0.0` or earlier, in the WordPress admin under Plugins, or in `wp-content/plugins/`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the Ecommerce Affiliate plugin through 1.0.0 is exposed, since the one-time password flow can be abused without logging in. The sources do not say whether any configuration avoids the flaw. Sites that do not have this plugin installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000737,"input_tokens":4536,"output_tokens":567,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor or plugin repository advisory for the fixed version and any setting or removal guidance; NVD text alone gives no fix.","search":"'-02':106B '-04':107B '-106015':19A,22A '-2026':18A,21A '1.0.0':5A,46B,117C '2027':105B '8.1':90B 'account':11A,27B,61B,131C,144C 'account-takeov':26B 'administr':85B,146C 'affili':2A,31B,42B,113C 'affiliate':25A 'allow':137C 'anyon':7A 'attack':71B,139C 'attempt':68B,136C 'brute':74B 'brute-forc':73B 'close':97B 'code':16A,77B 'cve':17A,20A 'cvss':89B 'ecommerc':1A,30B,41B,112C 'ecommerce':24A 'ecommerce-affili':29B 'ecommerce-affiliate':23A 'email':14A,54B 'exist':93B 'exploit':109B 'fix':34B,92B 'forc':75B 'guess':13A 'host':38B 'includ':84B,145C 'issuanc':56B,125C 'legitim':130C 'let':6A 'limit':66B,134C 'log':79B 'login':15A 'no-fix':32B 'one':51B,122C 'one-tim':121C 'one-time-password':50B 'otp':55B 'owner':62B,132C 'packag':35B 'password':53B,124C 'plugin':4A,44B,99B,115C 'poc':103B 'rate':87B 'report':110B 'restrict':120C 'self':37B 'self-host':36B 'take':8A,141C 'takeov':28B 'tie':49B 'time':52B,123C 'unauthent':70B,138C 'user':83B 'verif':58B,67B,127C,135C 'withhold':101B 'wordpress':3A,39B,43B,114C 'wordpress.org':95B 'wpscan':86B,100B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Ecommerce Affiliate plugin (ecommerce-affiliate, version 1.0.0, the only release) installed and active is exposed: the email one-time-password login can be abused without logging in, giving access to any account including administrators. Sites without this plugin can skip it. No plugin setting is documented that avoids the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ecommerceaffiliate"],"ptokens":["affiliate","ecommerce"],"labels":["accounttakeover","critical","ecommerceaffiliate","nofix","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-106015':19A,22A '-2026':18A,21A '1.0.0':5A 'account':11A 'affili':2A 'affiliate':25A 'anyon':7A 'code':16A 'cve':17A,20A 'ecommerc':1A 'ecommerce':24A 'ecommerce-affiliate':23A 'email':14A 'guess':13A 'let':6A 'login':15A 'plugin':4A 'take':8A 'wordpress':3A","search_b":"'-02':106B '-04':107B '1.0.0':46B '2027':105B '8.1':90B 'account':27B,61B 'account-takeov':26B 'administr':85B 'affili':31B,42B 'attack':71B 'attempt':68B 'brute':74B 'brute-forc':73B 'close':97B 'code':77B 'cvss':89B 'ecommerc':30B,41B 'ecommerce-affili':29B 'email':54B 'exist':93B 'exploit':109B 'fix':34B,92B 'forc':75B 'host':38B 'includ':84B 'issuanc':56B 'limit':66B 'log':79B 'no-fix':32B 'one':51B 'one-time-password':50B 'otp':55B 'owner':62B 'packag':35B 'password':53B 'plugin':44B,99B 'poc':103B 'rate':87B 'report':110B 'self':37B 'self-host':36B 'takeov':28B 'tie':49B 'time':52B 'unauthent':70B 'user':83B 'verif':58B,67B 'withhold':101B 'wordpress':39B,43B 'wordpress.org':95B 'wpscan':86B,100B","search_c":"'1.0.0':117C 'account':131C,144C 'administr':146C 'affili':113C 'allow':137C 'attack':139C 'attempt':136C 'ecommerc':112C 'includ':145C 'issuanc':125C 'legitim':130C 'limit':134C 'one':122C 'one-tim':121C 'owner':132C 'password':124C 'plugin':115C 'restrict':120C 'take':141C 'time':123C 'unauthent':138C 'verif':127C,135C 'wordpress':114C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106015","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106015:2167","url":"https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/","severity":null,"published_at":"2026-11-08T06:48:41+00:00","modified_at":"2026-11-08T06:48:41+00:00","first_seen_at":"2026-11-08T06:48:41+00:00","fetched_at":"2026-11-08T06:48:41+00:00","note":"WPScan (researchers Marcolini/Marchesini/Dottor Marc) says <=1.0.0, CVSS 8.1, no known fix, PoC withheld until 2027-02-04. WordPress.org page shows plugin closed 2026-10-23. Nothing marked verified: no vendor advisory exists; remove plugin is my recommendation. X not checked.","cites":["https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/","https://wordpress.org/plugins/ecommerce-affiliate/"]}],"documents":[{"id":100283,"url":"https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/","title":"WPScan: Ecommerce Affiliate <= 1.0.0 Unauthenticated Account Takeover via Email OTP Brute Force","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":100284,"url":"https://wordpress.org/plugins/ecommerce-affiliate/","title":"Ecommerce Affiliate - WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}