CVE-2026-105983
validatedZero produced an exploit or a check.description
Email Marketing 4Dem for WordPress through version 2.0.5 is affected by missing authorization checks in certain AJAX and REST interfaces. An unauthenticated remote attacker may read stored plugin information and alter plugin settings when those interfaces are reachable.
mitigation
Restrict unauthenticated access to the plugin's affected AJAX and REST interfaces, or disable the plugin until a corrected release is available. Monitor the vendor for an update and apply it promptly.
outcome
Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-14 06:00Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-105983
{ "etk_id": "ETK-2026-4446", "cve_id": "CVE-2026-105983", "display_id": "CVE-2026-105983", "ghsa_id": null, "euvd_id": "EUVD-2026-125855", "status": "published", "anchor_state": "anchored", "title": "Missing authorization in Email Marketing 4Dem", "summary": "Email Marketing 4Dem for WordPress through version 2.0.5 is affected by missing authorization checks in certain AJAX and REST interfaces. An unauthenticated remote attacker may read stored plugin information and alter plugin settings when those interfaces are reachable.", "mitigation": "Restrict unauthenticated access to the plugin's affected AJAX and REST interfaces, or disable the plugin until a corrected release is available. Monitor the vendor for an update and apply it promptly.", "vendor": null, "product": "Email Marketing 4Dem", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 2.0.5" ], "ecosystem": null, "fixed_versions": [], "package_name": "Email Marketing 4Dem", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": true, "pipeline_minutes": 29.793874516666666, "t0_at": "2026-11-14T06:00:05.988000+00:00", "signals": { "check": { "at": "2026-11-14T07:12:01.361331+00:00", "days": 0.049946450590277774, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:05.988000+00:00", "url": null }, "exploit": { "at": "2026-11-14T07:12:01.361331+00:00", "days": 0.049946450590277774, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:05.988000+00:00", "url": null }, "trigger_signal": { "at": "2026-11-14T06:00:05.988000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:05.988000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105983" } } }
published 2026-11-14 06:42Z
last change 2026-11-14 07:41Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.