CVE-2026-121866 · Package
NO FIX YET · SEE WHAT TO DO
The iLeads SMS Gateway WordPress plugin before 2.0.0 has AJAX actions that skip capability and nonce checks, so any logged-in user can change arbitrary WordPress options. An attacker can enable open registration with administrator as the default role and escalate to administrator.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 are exposed, and the attacker needs any logged-in account, such as a subscriber. Sites without this plugin, or with it already updated to 2.0.0 or later, are not affected. The sources do not say whether registration or default-role settings change the risk beyond the example given.
Not affected if no-user-accounts, plugin-not-installed, version-2.0.0-or-later
Who cares self-hosted, wordpress, wordpress-plugin
ileads-sms-gateway or similar exists under wp-content/plugins/ and read its version in the plugin header2.0.02.0.0 or laterThe iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.