{"id":"CVE-2026-105984","kind":"vulnerability","aliases":["CVE-2026-105984"],"related":[],"title":"Email Marketing 4Dem WordPress plugin: unauthenticated users can delete its data","description":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.","summary":"The Email Marketing 4Dem WordPress plugin through version 2.0.5 has AJAX actions that skip authorization checks. An unauthenticated visitor can destroy the plugin's stored configuration and delete its records.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"email-marketing-4dem","fixed":[],"affected":"<= 2.0.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["email-marketing-4dem","package","unauthenticated","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin under Plugins, look for Email Marketing 4Dem (slug email-marketing-4dem). Any installed version up to 2.0.5 is affected, and 2.0.5 is the latest release. From a shell: wp plugin list --name=email-marketing-4dem --fields=name,version,status","fix":"No patched release. The WordPress.org page lists 2.0.5 as the latest version and says the plugin was closed on November 3, 2026 pending a full review. Deactivate and delete the plugin until a fixed release exists.","status":"open","published_at":"2026-11-14T07:17:16+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","triaged_at":"2026-11-14T07:28:24+00:00","updated_at":"2026-11-14T07:29:31+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-14T07:28:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Email Marketing 4Dem WordPress plugin: unauthenticated users can delete its data","impact":"medium","summary":"The Email Marketing 4Dem WordPress plugin through version 2.0.5 has AJAX actions that skip authorization checks. An unauthenticated visitor can destroy the plugin's stored configuration and delete its records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","email-marketing-4dem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker wipes plugin configuration and deletes its stored records","analyst_note":"Confirm the affected version range and whether a patched release exists at the NVD entry or the plugin's WordPress.org page.","how_to_check":"- Check whether the `Email Marketing 4Dem` plugin is installed and its version in the WordPress admin under Plugins.\n- Check whether the installed version is `2.0.5` or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Email Marketing 4Dem plugin at version 2.0.5 or earlier are exposed, since its AJAX actions accept requests without checking who is calling. Sites without the plugin are not affected. The sources do not say whether a default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4525,"output_tokens":526,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected version range and whether a patched release exists at the NVD entry or the plugin's WordPress.org page.","search":"'-105984':14A,17A '-2026':13A,16A '2.0.5':40B,69C '4dem':3A,21A,25B,35B,65C 'action':43B,82C 'ajax':42B,81C 'allow':83C 'author':46B,73C 'capabl':75C 'check':47B,76C 'configur':57B,90C 'cve':12A,15A 'data':11A 'delet':9A,59B,92C 'destroy':52B,87C 'email':1A,19A,23B,33B,63C 'email-marketing-4dem':18A,22B 'market':2A,24B,34B,64C 'marketing':20A 'packag':26B 'perform':72C 'plugin':5A,31B,37B,54B,67C 'record':61B,94C 'sever':78C 'skip':45B 'store':56B,89C 'unauthent':6A,27B,49B,84C 'user':7A,85C 'version':39B 'visitor':50B 'wordpress':4A,28B,30B,36B,66C 'wordpress-plugin':29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Email Marketing 4Dem plugin at version 2.0.5 or earlier are exposed, since its AJAX actions accept requests without checking who is calling. Sites without the plugin are not affected. The sources do not say whether a default configuration is required.","tier":"B","verified":{"fix":{"at":"2026-11-14T07:29:31Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984","run_id":3966},"products":{"at":"2026-11-14T07:29:31Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984","run_id":3966}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["emailmarketing4dem"],"ptokens":["4dem","email","marketing"],"labels":["emailmarketing4dem","high","package","unauthenticated","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-105984':14A,17A '-2026':13A,16A '4dem':3A,21A 'cve':12A,15A 'data':11A 'delet':9A 'email':1A,19A 'email-marketing-4dem':18A 'market':2A 'marketing':20A 'plugin':5A 'unauthent':6A 'user':7A 'wordpress':4A","search_b":"'2.0.5':40B '4dem':25B,35B 'action':43B 'ajax':42B 'author':46B 'check':47B 'configur':57B 'delet':59B 'destroy':52B 'email':23B,33B 'email-marketing-4dem':22B 'market':24B,34B 'packag':26B 'plugin':31B,37B,54B 'record':61B 'skip':45B 'store':56B 'unauthent':27B,49B 'version':39B 'visitor':50B 'wordpress':28B,30B,36B 'wordpress-plugin':29B","search_c":"'2.0.5':69C '4dem':65C 'action':82C 'ajax':81C 'allow':83C 'author':73C 'capabl':75C 'check':76C 'configur':90C 'delet':92C 'destroy':87C 'email':63C 'market':64C 'perform':72C 'plugin':67C 'record':94C 'sever':78C 'store':89C 'unauthent':84C 'user':85C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984","severity":null,"published_at":"2026-11-14T07:17:16+00:00","modified_at":"2026-11-14T07:17:16+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","fetched_at":"2026-11-14T07:27:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105984:3966","url":"https://wordpress.org/plugins/email-marketing-4dem/","severity":null,"published_at":"2026-11-14T07:29:31+00:00","modified_at":"2026-11-14T07:29:31+00:00","first_seen_at":"2026-11-14T07:29:31+00:00","fetched_at":"2026-11-14T07:29:31+00:00","note":"NVD text: no auth/capability checks on AJAX actions, through 2.0.5. The NVD page did not render, so I used the CVE text from the signal. WordPress.org shows 2.0.5 as latest and the plugin closed on 2026-11-03 pending review. No exploitation or PoC found; I did not search social media. The fix claim is verified from the plugin page; the AJAX action names are unknown.","cites":["https://wordpress.org/plugins/email-marketing-4dem/","https://nvd.nist.gov/vuln/detail/CVE-2026-105984"]}],"documents":[{"id":153720,"url":"https://wordpress.org/plugins/email-marketing-4dem/","title":"Email Marketing 4Dem - WordPress.org (plugin closed Nov 3, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"This plugin has been closed as of November 3, 2026 and is not available for download. This closure is temporary, pending a full review. Version 2.0.5, last updated January 17, 2025.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":153721,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984","title":"NVD CVE-2026-105984","kind":"advisory","source":"analyst","publisher":null,"text":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}