The vulnerability allows an unauthenticated user to trigger the sending of a one‑time password (OTP) for any user account and subsequently attempt to verify the OTP without any ownership checks. Because the plugin does not restrict the OTP issuance to the legitimate account owner or limit the number of verification attempts, an attacker can brute force the OTP. Successful exploitation results in full takeover of the victim’s account, including administrative privileges, enabling modification or deletion of site content, theft of sensitive data, and further lateral movement within the WordPress installation.

WordPress sites using the Ecommerce Affiliate plugin version 1.0.0 or earlier are affected. The vendor information is listed as "Unknown" in the CNA data; the plugin is identified only as "Ecommerce Affiliate". The issue applies to all user accounts, including administrators, since no ownership checks are performed during OTP verification.

The risk is high because the plugin allows any attacker to obtain a one‑time password for any user, including administrators, through an unauthenticated endpoint. Without rate limiting or ownership validation, an attacker can brute force the OTP and ultimately gain full control of the target account. EPSS score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, but the lack of protective controls makes exploitation technically feasible. The likely attack vector is unauthenticated access to the OTP issuance and verification endpoints, followed by brute‑forcing attempts until the correct code is guessed.