Could you explain more about what the rebranded plugin does that is deceptive? Is it something like every few clicks the commission goes somewhere other than where the site operator expects (i.e., back to the author of the rebranded version)?

Once you install the plugin, what exactly does it say that confuses the user? How does one implement the commission process normally and what does this plugin do to change that? Do you have screenshots?

If you can explain exactly how this deceives the public then file a complaint with the FTC: https://www.ftccomplaintassistant.gov/ They have gone after malware/spyware in the past that didn’t disclose what it was doing and this sounds similarly deceptive.

I don’t think this is a GPL/copyright issue because the GPL gives anyone the right to rebrand your plugin, modify it, etc. Engaging in fraud isn’t itself a violation of copyright law, so you should focus instead on explaining what false or misleading statements this rebrander makes. [Edit: Although, if they also remove your copyright notices, etc. so as to make it look like the code you wrote was written by them, then that is definitely (C) infringement and a violation of the GPL as well. It’s not clear to me from your post how far they went to cover their tracks.)