Unauthenticated Configuration Deletion in Email Marketing 4Dem WordPress Plugin

Executive Summary

The vulnerability CVE-2026-105984 affects the WordPress plugin Email Marketing 4Dem versions up to 2.0.5. It allows unauthenticated users to destroy the plugin's stored configuration and delete its records due to missing authorization checks on certain AJAX actions.

Useful 0 Not Useful 0

Detection Guidance

Check if the Email Marketing 4Dem WordPress plugin version 2.0.5 or lower is installed. Look for unauthorized changes to plugin configuration or missing records. Monitor network traffic for suspicious AJAX requests targeting the vulnerable plugin actions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to delete critical plugin data or reset configurations, potentially disrupting email marketing operations or causing data loss for users of the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Email Marketing 4Dem plugin to the latest version immediately. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Review plugin settings and logs for signs of unauthorized access or changes.

Useful 0 Not Useful 0