CVE-2026-106015
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 08, 2026
Vendor
unknown
Description
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.