{"affected":[{"defaultStatus":"unknown","product":"Ecommerce Affiliate","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106015","cwes":["CWE-287"],"description":"The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/"}],"kev":null,"metrics":[],"modifiedAt":1794117630488,"publishedAt":1794117630488,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/"}],"remediation":[],"revision":"3c29595635353494b287abce03b04b22a71cd4bb98b98f39750984d1b4b9ad3f","sources":[{"modifiedAt":1794117630488,"name":"CNA: WPScan","retrievedAt":1794118108013,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106015"}],"ssvc":null,"status":"published","title":"Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force","updatedAt":1794118108013}