{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105984", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-06T10:03:28.391Z", "datePublished": "2026-11-14T06:00:06.166Z", "dateUpdated": "2026-11-14T06:00:06.166Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-14T06:00:06.166Z"}, "title": "Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Email Marketing 4Dem", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "2.0.5"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records."}], "references": [{"url": "https://wpscan.com/vulnerability/cd7a147a-b2e9-45b5-a06a-68c3bea771d8/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Naoki Kawahigashi", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Email Marketing 4Dem", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "2.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records."}], "id": "CVE-2026-105984", "lastModified": "2026-11-14T07:17:16.137", "metrics": {}, "published": "2026-11-14T07:17:16.137", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/cd7a147a-b2e9-45b5-a06a-68c3bea771d8/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.5]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}]}, "original": {"product": "Email Marketing 4Dem", "source": "cna", "vendor": "Unknown"}, "product": "email_marketing_4dem", "vendor": "wordpress-extensions"}], "created": "2026-11-14T12:00:10.253235+00:00", "updated": "2026-11-14T22:18:17.170041+00:00", "vendors": ["wordpress-extensions", "wordpress-extensions$PRODUCT$email_marketing_4dem"], "weaknesses": ["CWE-284"]}