WordPress Plugin Vulnerabilities

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

Description

The plugin does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
ecommerce-affiliate
No known fix

References

CVE
CVE-2026-106015

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
7222ff86-fc0e-42e5-ac68-f9506c90fb70

Timeline

Publicly Published
2026-11-06 (about 2 days ago)
Added
2026-11-06 (about 1 day ago)
Last Updated
2026-11-06 (about 1 day ago)

Other

Published
Title
Published
2025-06-11
Title
Workreap < 3.3.2 - Authentication Bypass via 'workreap_verify_user_account'
Published
2025-03-07
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon < 200.3.10 - Authentication Bypass
Published
2026-10-03
Title
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
Published
2026-10-30
Title
Welcart e-Commerce < 2.12.6 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Published
2026-10-19
Title
Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token