CVE-2026-106015

{
  "etk_id": "ETK-2026-3883",
  "cve_id": "CVE-2026-106015",
  "display_id": "CVE-2026-106015",
  "ghsa_id": "GHSA-xxh9-x8mr-vqr4",
  "euvd_id": "EUVD-2026-119475",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "OTP authorization flaws in Ecommerce Affiliate",
  "summary": "Ecommerce Affiliate for WordPress through version 1.0.0 has insufficient controls around one-time-password issuance and verification. An unauthenticated attacker may take over user accounts, including administrator accounts, because OTP operations are not adequately associated with the intended account and verification attempts are not limited.",
  "mitigation": "Disable or remove the affected plugin until you can confirm that a vendor update corrects the OTP ownership and attempt-limiting controls. Restrict access to WordPress authentication functions and review accounts for unauthorized changes.",
  "vendor": null,
  "product": "Ecommerce Affiliate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ecommerce Affiliate",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-08T06:00:30.488000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-08T06:00:30.488000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:30.488000+00:00",
      "url": "https://github.com/advisories/GHSA-xxh9-x8mr-vqr4"
    }
  }
}