---
id: "CVE-2026-105983"
page: "https://infrastack.ai/live/CVE-2026-105983"
kind: "vulnerability"
aliases: ["CVE-2026-105983"]
title: "Email Marketing 4Dem WordPress plugin: unauthenticated users can read and change settings"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "email-marketing-4dem", "fixed": [], "affected": "<= 2.0.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["email-marketing-4dem", "package", "unauthenticated", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-above-2.0.5"]
published_at: "2026-11-14T07:17:12+00:00"
first_seen_at: "2026-11-14T07:27:44+00:00"
updated_at: "2026-11-14T07:29:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105983", "first_seen_at": "2026-11-14T07:27:44+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/email-marketing-4dem/", "first_seen_at": "2026-11-14T07:29:36+00:00", "cites": ["https://wordpress.org/plugins/email-marketing-4dem/"]}]
exploit_sources: []
---

# Email Marketing 4Dem WordPress plugin: unauthenticated users can read and change settings

Link for people: https://infrastack.ai/live/CVE-2026-105983 (this .md is for agents)

The Email Marketing 4Dem WordPress plugin through 2.0.5 skips authorization checks on several AJAX actions and REST routes. An unauthenticated visitor can read the plugin's stored configuration and data and change its stored settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:email-marketing-4dem affected <= 2.0.5 fixed no fixed version listed

## How to check

Run: wp plugin get email-marketing-4dem --field=version (slug from WordPress.org). Any installed version up to 2.0.5 is in the affected range; 2.0.5 is the latest release.

## Fix

No fixed version: 2.0.5 is the latest release and WordPress.org closed the plugin on 2026-11-03 pending review. Deactivate and delete it until a patched release appears.

## Timeline

- 2026-11-14T07:27:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105983
- 2026-11-14T07:29:36+00:00 analyst https://wordpress.org/plugins/email-marketing-4dem/ — Slug email-marketing-4dem confirmed on wordpress.org. Plugin closed 2026-11-03, no release after 2.0.5, so no fix exists. No vendor or WPScan advisory found; affected range comes from NVD only. Exploitation and PoC unknown.

## Documents

- [fix] Email Marketing 4Dem - WordPress.org (plugin closed Nov 3, 2026) https://wordpress.org/plugins/email-marketing-4dem/

## From the sources

The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_