{"api_version":"1","generated_at":"2026-11-14T23:50:28+00:00","cve":"CVE-2026-105984","urls":{"html":"https://cve.report/CVE-2026-105984","api":"https://cve.report/api/cve/CVE-2026-105984.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-105984","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984"},"summary":{"title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion","description":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-14 07:17:16","updated_at":"2026-11-14 07:17:16"},"problem_types":["CWE-862 Missing Authorization"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/cd7a147a-b2e9-45b5-a06a-68c3bea771d8/","name":"https://wpscan.com/vulnerability/cd7a147a-b2e9-45b5-a06a-68c3bea771d8/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105984","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105984","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Email Marketing 4Dem","version":"affected 2.0.5 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Naoki Kawahigashi","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Email Marketing 4Dem","vendor":"Unknown","versions":[{"lessThanOrEqual":"2.0.5","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Naoki Kawahigashi"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records."}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T06:00:06.166Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/cd7a147a-b2e9-45b5-a06a-68c3bea771d8/"}],"source":{"discovery":"EXTERNAL"},"title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-105984","datePublished":"2026-11-14T06:00:06.166Z","dateReserved":"2026-10-06T10:03:28.391Z","dateUpdated":"2026-11-14T06:00:06.166Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 07:17:16","lastModifiedDate":"2026-11-14 07:17:16","problem_types":["CWE-862 Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105984","Ordinal":"1","Title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration De","CVE":"CVE-2026-105984","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105984","Ordinal":"1","NoteData":"The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.","Type":"Description","Title":"Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration De"}]}}}