Ecommerce Affiliate: Unauthenticated account takeover via OTP vulnerability (CVE-2026-106015)
The Ecommerce Affiliate plugin for WordPress versions 1.0.0 and below contains a flaw in the OTP authentication flow that allows unauthenticated attackers to perform account takeovers by bypassing verification restrictions.
CVE search metadata
CVE search record: CVE-2026-106015. Severity: high. CVSS: 8.1. KEV: no. Product: Ecommerce Affiliate (<= 1.0.0). Brief: Ecommerce Affiliate: Unauthenticated account takeover via OTP vulnerability (CVE-2026-106015). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ecommerce-affiliate-otp-bypass/
Triage facts
Revision 1- Applicability
- Ecommerce Affiliate (<= 1.0.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 21:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Ecommerce Affiliate plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-106015) in its one-time password (OTP) verification process. The plugin fails to restrict OTP issuance to legitimate owners and lacks rate limiting on verification attempts. This allows an unauthenticated attacker to brute-force or bypass the OTP verification, leading to full account takeover, including administrative accounts.
Impact
Unauthenticated attackers can gain unauthorized access to any user account on a site running the affected plugin, potentially resulting in full site compromise if an administrator account is targeted.
Recommendation
- Audit WordPress installations for the presence of the Ecommerce Affiliate plugin.
- Disable or remove the Ecommerce Affiliate plugin until a security patch is provided by the developer.
- Monitor logs for abnormal spikes in authentication-related traffic targeting the plugin's endpoints.
Immediate actions
Inventory all WordPress sites to identify if the Ecommerce Affiliate plugin is active.
Threat Hunt
Monitor web access logs for high volumes of POST requests to OTP verification endpoints associated with the Ecommerce Affiliate plugin.
Data: Web server access logs
Mitigations
Deactivate and remove the Ecommerce Affiliate plugin until a patch is released.
CVE-2026-106015