CVE-2026-106015: Account Takeover via One-Time Password Abuse
A high-severity vulnerability has been published in the Ecommerce Affiliate WordPress plugin. Tracked as CVE-2026-106015 with a CVSS score of 8.1, it affects versions through 1.0.0.
The plugin does not restrict one-time password (OTP) issuance and verification to the legitimate account owner, and it does not limit verification attempts. An unauthenticated attacker can request an OTP for any account and guess it, taking over any account, including administrators.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-106015 |
| CVSS Score | 8.1 (High) |
| Affected Plugin | Ecommerce Affiliate (WordPress) |
| Affected Versions | 1.0.0 and earlier |
| Authentication Required | None |
| Impact | Takeover of any account, including administrators |
| Published | 2026-11-08 |
Why This Matters
Two weaknesses combine here: OTPs can be issued for accounts the requester does not own, and there is no attempt limit. Without rate limiting, a short numeric code can be brute-forced. Taking over an administrator account gives an attacker control of the whole WordPress site.
Remediation
- Identify sites running Ecommerce Affiliate and confirm the version.
- Apply a vendor fix when one is available. The NVD entry lists no patched version at the time of writing.
- Deactivate and remove the plugin if no fix exists.
- Add rate limiting to the plugin's OTP endpoints at the WAF or reverse proxy as a stopgap.
- Review recent logins and password resets, especially for administrator accounts, and force a password reset where activity looks suspicious.