CVE-2026-105984: Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion
The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit the affected AJAX actions because they do not require authorization or capability checks.
What can an attacker do through the vulnerable actions?
An attacker can destroy the plugin's stored configuration and delete its records. The provided information describes data destruction, not access to site administration or code execution.
Which installations are known to be affected?
Email Marketing 4Dem for WordPress versions through 2.0.5 are affected. The provided information does not state whether any particular plugin configuration is required.
How can I determine whether an instance may be vulnerable?
Check whether the Email Marketing 4Dem plugin is installed and identify its version. Versions 2.0.5 or earlier fall within the affected range.