---
id: "CVE-2026-105984"
page: "https://infrastack.ai/live/CVE-2026-105984"
kind: "vulnerability"
aliases: ["CVE-2026-105984"]
title: "Email Marketing 4Dem WordPress plugin: unauthenticated users can delete its data"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "email-marketing-4dem", "fixed": [], "affected": "<= 2.0.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["email-marketing-4dem", "package", "unauthenticated", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-14T07:17:16+00:00"
first_seen_at: "2026-11-14T07:27:44+00:00"
updated_at: "2026-11-14T07:29:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105984", "first_seen_at": "2026-11-14T07:27:44+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105984", "first_seen_at": "2026-11-14T07:29:31+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-105984", "https://wordpress.org/plugins/email-marketing-4dem/"]}]
exploit_sources: []
---

# Email Marketing 4Dem WordPress plugin: unauthenticated users can delete its data

Link for people: https://infrastack.ai/live/CVE-2026-105984 (this .md is for agents)

The Email Marketing 4Dem WordPress plugin through version 2.0.5 has AJAX actions that skip authorization checks. An unauthenticated visitor can destroy the plugin's stored configuration and delete its records.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:email-marketing-4dem affected <= 2.0.5 fixed no fixed version listed

## How to check

In WordPress admin under Plugins, look for Email Marketing 4Dem (slug email-marketing-4dem). Any installed version up to 2.0.5 is affected, and 2.0.5 is the latest release. From a shell: wp plugin list --name=email-marketing-4dem --fields=name,version,status

## Fix

No patched release. The WordPress.org page lists 2.0.5 as the latest version and says the plugin was closed on November 3, 2026 pending a full review. Deactivate and delete the plugin until a fixed release exists.

## Timeline

- 2026-11-14T07:27:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105984
- 2026-11-14T07:29:31+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-105984 — NVD text: no auth/capability checks on AJAX actions, through 2.0.5. The NVD page did not render, so I used the CVE text from the signal. WordPress.org shows 2.0.5 as latest and the plugin closed on 2026-11-03 pending review. No exploitation or PoC found; I did not search social media. The fix claim is verified from the plugin page; the AJAX action names are unknown.

## Documents

- [advisory] NVD CVE-2026-105984 https://nvd.nist.gov/vuln/detail/CVE-2026-105984
- [fix] Email Marketing 4Dem - WordPress.org (plugin closed Nov 3, 2026) https://wordpress.org/plugins/email-marketing-4dem/

## From the sources

The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_