Unrated severityNVD Advisory· Published Nov 8, 2026

CVE-2026-106015

Description

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ecommerce Affiliatellm-create
Range: <=1.0.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000