{"api_version":"1","generated_at":"2026-11-14T23:50:27+00:00","cve":"CVE-2026-105983","urls":{"html":"https://cve.report/CVE-2026-105983","api":"https://cve.report/api/cve/CVE-2026-105983.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-105983","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105983"},"summary":{"title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modification and Configuration Disclosure","description":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-14 07:17:12","updated_at":"2026-11-14 07:17:12"},"problem_types":["CWE-862 Missing Authorization"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/9f280371-d1de-4bf9-8200-44b8e3e4b71d/","name":"https://wpscan.com/vulnerability/9f280371-d1de-4bf9-8200-44b8e3e4b71d/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105983","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105983","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Email Marketing 4Dem","version":"affected 2.0.5 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Pablo González Pérez","lang":"en"},{"source":"CNA","value":"Francisco José Ramírez Vicente","lang":"en"},{"source":"CNA","value":"and Iñigo Sánchez Enciso","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Email Marketing 4Dem","vendor":"Unknown","versions":[{"lessThanOrEqual":"2.0.5","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Pablo González Pérez"},{"lang":"en","type":"finder","value":"Francisco José Ramírez Vicente"},{"lang":"en","type":"finder","value":"and Iñigo Sánchez Enciso"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings."}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T06:00:05.988Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9f280371-d1de-4bf9-8200-44b8e3e4b71d/"}],"source":{"discovery":"EXTERNAL"},"title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modification and Configuration Disclosure","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-105983","datePublished":"2026-11-14T06:00:05.988Z","dateReserved":"2026-10-06T10:03:26.521Z","dateUpdated":"2026-11-14T06:00:05.988Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 07:17:12","lastModifiedDate":"2026-11-14 07:17:12","problem_types":["CWE-862 Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105983","Ordinal":"1","Title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modific","CVE":"CVE-2026-105983","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105983","Ordinal":"1","NoteData":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.","Type":"Description","Title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modific"}]}}}