CVE-2026-105983: Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modification and Configuration Disclosure
The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit the affected AJAX actions and REST routes because they lack authorization and capability checks. No WordPress account or plugin-level privilege is required.
What information and changes are at risk?
An attacker can disclose configuration and data stored by the Email Marketing 4Dem plugin, and can modify the plugin's stored settings. The available information does not identify the specific configuration fields or settings affected.
Which installations should be treated as affected?
Sites running Email Marketing 4Dem through version 2.0.5 should be treated as affected. The issue is in exposed AJAX actions and REST routes, so public reachability of the WordPress site is relevant to exposure.