{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ecommerce-affiliate--1.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ecommerce_affiliate_project:ecommerce_affiliate:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-106015"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ecommerce Affiliate (\u003c= 1.0.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","authentication-bypass","cve-2026-106015"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Ecommerce Affiliate plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-106015) in its one-time password (OTP) verification process. The plugin fails to restrict OTP issuance to legitimate owners and lacks rate limiting on verification attempts. This allows an unauthenticated attacker to brute-force or bypass the OTP verification, leading to full account takeover, including administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthenticated attackers can gain unauthorized access to any user account on a site running the affected plugin, potentially resulting in full site compromise if an administrator account is targeted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress installations for the presence of the Ecommerce Affiliate plugin.\u003c/li\u003e\n\u003cli\u003eDisable or remove the Ecommerce Affiliate plugin until a security patch is provided by the developer.\u003c/li\u003e\n\u003cli\u003eMonitor logs for abnormal spikes in authentication-related traffic targeting the plugin's endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T21:27:59Z","date_published":"2026-11-08T21:27:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ecommerce-affiliate-otp-bypass/","summary":"The Ecommerce Affiliate plugin for WordPress versions 1.0.0 and below contains a flaw in the OTP authentication flow that allows unauthenticated attackers to perform account takeovers by bypassing verification restrictions.","title":"Ecommerce Affiliate: Unauthenticated account takeover via OTP vulnerability (CVE-2026-106015)","url":"https://feed.craftedsignal.io/briefs/2026-11-ecommerce-affiliate-otp-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Ecommerce Affiliate (\u003c= 1.0.0)","version":"https://jsonfeed.org/version/1.1"}