{"id":"CVE-2026-105983","kind":"vulnerability","aliases":["CVE-2026-105983"],"related":[],"title":"Email Marketing 4Dem WordPress plugin: unauthenticated users can read and change settings","description":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.","summary":"The Email Marketing 4Dem WordPress plugin through 2.0.5 skips authorization checks on several AJAX actions and REST routes. An unauthenticated visitor can read the plugin's stored configuration and data and change its stored settings.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"email-marketing-4dem","fixed":[],"affected":"<= 2.0.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["email-marketing-4dem","package","unauthenticated","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-above-2.0.5"],"how_to_check":"Run: wp plugin get email-marketing-4dem --field=version (slug from WordPress.org). Any installed version up to 2.0.5 is in the affected range; 2.0.5 is the latest release.","fix":"No fixed version: 2.0.5 is the latest release and WordPress.org closed the plugin on 2026-11-03 pending review. Deactivate and delete it until a patched release appears.","status":"open","published_at":"2026-11-14T07:17:12+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","triaged_at":"2026-11-14T07:28:25+00:00","updated_at":"2026-11-14T07:29:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T07:28:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Email Marketing 4Dem WordPress plugin: unauthenticated users can read and change settings","impact":"medium","summary":"The Email Marketing 4Dem WordPress plugin through 2.0.5 skips authorization checks on several AJAX actions and REST routes. An unauthenticated visitor can read the plugin's stored configuration and data and change its stored settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","email-marketing-4dem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers read stored data and alter plugin settings","analyst_note":"Confirm a fixed version and the plugin slug from the vendor or WPScan advisory; the NVD entry gives no fix.","how_to_check":"- Look for the `Email Marketing 4Dem` plugin in the WordPress admin under Plugins, and check whether its version is `2.0.5` or earlier\n- Run `wp plugin get <plugin-slug> --field=version` on the site (plugin slug unknown from the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.0.5"],"who_is_affected":"Sites running the Email Marketing 4Dem WordPress plugin version 2.0.5 or earlier are exposed, because its AJAX and REST endpoints do not check who is calling. Sites that do not have the plugin installed are not affected. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4562,"output_tokens":589,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm a fixed version and the plugin slug from the vendor or WPScan advisory; the NVD entry gives no fix.","search":"'-105983':15A,18A '-2026':14A,17A '2.0.5':40B,75C,104C '4dem':3A,22A,26B,36B,71C,100C 'action':47B,88C 'ajax':46B,87C 'allow':92C 'author':42B,79C 'capabl':81C 'chang':11A,64B 'check':43B,82C 'configur':60B,107C 'cve':13A,16A 'data':62B,109C 'disclos':96C 'email':1A,20A,24B,34B,69C,98C 'email-marketing-4dem':19A,23B 'market':2A,25B,35B,70C,99C 'marketing':21A 'modifi':112C 'packag':27B 'perform':78C 'plugin':5A,32B,38B,57B,73C,102C 'read':9A,55B 'rest':49B,90C 'rout':50B,91C 'set':12A,67B,115C 'sever':45B,84C 'skip':41B 'store':59B,66B,106C,114C 'unauthent':6A,28B,52B,93C 'user':7A,94C 'visitor':53B 'wordpress':4A,29B,31B,37B,72C,101C 'wordpress-plugin':30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Email Marketing 4Dem WordPress plugin version 2.0.5 or earlier are exposed, because its AJAX and REST endpoints do not check who is calling. Sites that do not have the plugin installed are not affected. The sources do not name a fixed version.","tier":"B","verified":{"fix":{"at":"2026-11-14T07:29:36Z","by":"analyst","doc":"https://wordpress.org/plugins/email-marketing-4dem/","run_id":3967}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["emailmarketing4dem"],"ptokens":["4dem","email","marketing"],"labels":["emailmarketing4dem","high","package","unauthenticated","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-105983':15A,18A '-2026':14A,17A '4dem':3A,22A 'chang':11A 'cve':13A,16A 'email':1A,20A 'email-marketing-4dem':19A 'market':2A 'marketing':21A 'plugin':5A 'read':9A 'set':12A 'unauthent':6A 'user':7A 'wordpress':4A","search_b":"'2.0.5':40B '4dem':26B,36B 'action':47B 'ajax':46B 'author':42B 'chang':64B 'check':43B 'configur':60B 'data':62B 'email':24B,34B 'email-marketing-4dem':23B 'market':25B,35B 'packag':27B 'plugin':32B,38B,57B 'read':55B 'rest':49B 'rout':50B 'set':67B 'sever':45B 'skip':41B 'store':59B,66B 'unauthent':28B,52B 'visitor':53B 'wordpress':29B,31B,37B 'wordpress-plugin':30B","search_c":"'2.0.5':75C,104C '4dem':71C,100C 'action':88C 'ajax':87C 'allow':92C 'author':79C 'capabl':81C 'check':82C 'configur':107C 'data':109C 'disclos':96C 'email':69C,98C 'market':70C,99C 'modifi':112C 'perform':78C 'plugin':73C,102C 'rest':90C 'rout':91C 'set':115C 'sever':84C 'store':106C,114C 'unauthent':93C 'user':94C 'wordpress':72C,101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105983","severity":null,"published_at":"2026-11-14T07:17:12+00:00","modified_at":"2026-11-14T07:17:12+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","fetched_at":"2026-11-14T07:27:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105983:3967","url":"https://wordpress.org/plugins/email-marketing-4dem/","severity":null,"published_at":"2026-11-14T07:29:36+00:00","modified_at":"2026-11-14T07:29:36+00:00","first_seen_at":"2026-11-14T07:29:36+00:00","fetched_at":"2026-11-14T07:29:36+00:00","note":"Slug email-marketing-4dem confirmed on wordpress.org. Plugin closed 2026-11-03, no release after 2.0.5, so no fix exists. No vendor or WPScan advisory found; affected range comes from NVD only. Exploitation and PoC unknown.","cites":["https://wordpress.org/plugins/email-marketing-4dem/"]}],"documents":[{"id":153720,"url":"https://wordpress.org/plugins/email-marketing-4dem/","title":"Email Marketing 4Dem - WordPress.org (plugin closed Nov 3, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"This plugin has been closed as of November 3, 2026 and is not available for download. This closure is temporary, pending a full review. Version 2.0.5, last updated January 17, 2025.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}