EMAIL-MARKETING-4DEM · CVE-2026-105983 · Package
NO FIX YET · SEE WHAT TO DO
The Email Marketing 4Dem WordPress plugin through 2.0.5 skips authorization checks on several AJAX actions and REST routes. An unauthenticated visitor can read the plugin's stored configuration and data and change its stored settings.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Email Marketing 4Dem WordPress plugin version 2.0.5 or earlier are exposed, because its AJAX and REST endpoints do not check who is calling. Sites that do not have the plugin installed are not affected. The sources do not name a fixed version.
Not affected if plugin-not-installed, version-above-2.0.5
Who cares email-marketing-4dem, unauthenticated, wordpress, wordpress-plugin
2.0.5 is in the affected range; 2.0.5 is the latest release2.0.5 is the latest release and WordPress.org closed the plugin on 2026-11-03 pending reviewThe Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.