Description
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ecommerce Affiliate | ≤ 1.0.0 | — |
References
- https://wpscan.com/vulnerability/7222ff86-fc0e-42e5-ac68-f9506c90fb70/ exploit vdb-entry technical-description