Ecommerce Affiliate
CVE-2026-106015: The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit
CVE-2026-106015 Nov 8, 2026 Source: Vendor
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-106015
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-106015
BR2026-0000-043467
unclaimed
Credited as Enrico Marcolini
CVE-2026-106015
BR2026-0000-043468
unclaimed
Credited as Claudio Marchesini
CVE-2026-106015
BR2026-0000-043469
unclaimed
Credited as Dottor Marc