EMAIL-MARKETING-4DEM · CVE-2026-105984 · Package
NO FIX YET · SEE WHAT TO DO
The Email Marketing 4Dem WordPress plugin through version 2.0.5 has AJAX actions that skip authorization checks. An unauthenticated visitor can destroy the plugin's stored configuration and delete its records.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Email Marketing 4Dem plugin at version 2.0.5 or earlier are exposed, since its AJAX actions accept requests without checking who is calling. Sites without the plugin are not affected. The sources do not say whether a default configuration is required.
Not affected if plugin-not-installed
Who cares email-marketing-4dem, unauthenticated, wordpress, wordpress-plugin
2.0.5 is affected, and 2.0.5 is the latest release2.0.5 as the latest version and says the plugin was closed on November 3, 2026 pending a full reviewThe Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.