{"id":"CVE-2026-121866","kind":"vulnerability","aliases":["CVE-2026-121866"],"related":[],"title":"WordPress iLeads SMS Gateway plugin lets subscribers change site options","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","summary":"The iLeads SMS Gateway WordPress plugin before 2.0.0 has AJAX actions that skip capability and nonce checks, so any logged-in user can change arbitrary WordPress options. An attacker can enable open registration with administrator as the default role and escalate to administrator.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-user-accounts","plugin-not-installed","version-2.0.0-or-later"],"how_to_check":"- Check whether the plugin folder `ileads-sms-gateway` or similar exists under `wp-content/plugins/` and read its version in the plugin header\n- In the WordPress admin, open Plugins and look for iLeads SMS Gateway by Exsile\n- Check the installed version is below `2.0.0`","fix":"- Update the iLeads SMS Gateway by Exsile plugin to `2.0.0` or later","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:18+00:00","updated_at":"2026-11-07T06:48:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the iLeads SMS Gateway by Exsile plugin to `2.0.0` or later","reach":"internet","title":"WordPress iLeads SMS Gateway plugin lets subscribers change site options","impact":"high","summary":"The iLeads SMS Gateway WordPress plugin before 2.0.0 has AJAX actions that skip capability and nonce checks, so any logged-in user can change arbitrary WordPress options. An attacker can enable open registration with administrator as the default role and escalate to administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"any subscriber can become administrator and take over the site","analyst_note":"Confirm the affected version range and whether a fixed release is published at https://nvd.nist.gov/vuln/detail/CVE-2026-121866; the sources only give 'before 2.0.0'.","how_to_check":"- Check whether the plugin folder `ileads-sms-gateway` or similar exists under `wp-content/plugins/` and read its version in the plugin header\n- In the WordPress admin, open Plugins and look for iLeads SMS Gateway by Exsile\n- Check the installed version is below `2.0.0`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.0.0-or-later","no-user-accounts"],"who_is_affected":"Sites running the iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 are exposed, and the attacker needs any logged-in account, such as a subscriber. Sites without this plugin, or with it already updated to 2.0.0 or later, are not affected. The sources do not say whether registration or default-role settings change the risk beyond the example given.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4249,"output_tokens":687,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121866':13A,16A '-2026':12A,15A '2.0.0':32B,78C 'action':35B,88C 'administr':60B,68B,114C,121C 'ajax':34B,87C 'allow':98C 'arbitrari':50B,108C 'attack':54B 'authent':100C 'capabl':38B,82C 'chang':8A,49B,107C 'check':41B,81C 'chosen':94C 'cve':11A,14A 'default':63B,124C 'enabl':56B,118C 'escal':66B,112C 'exampl':116C 'exsil':74C 'gateway':4A,28B,72C 'host':20B 'ilead':2A,26B,70C 'let':6A 'log':45B 'logged-in':44B 'nonc':40B,84C 'open':57B 'option':10A,52B,93C,110C 'packag':17B 'plugin':5A,24B,30B,76C 'registr':58B,119C 'request':97C 'role':64B,125C 'self':19B 'self-host':18B 'sever':86C 'site':9A,92C 'skip':37B 'sms':3A,27B,71C 'subscrib':7A,105C 'updat':90C 'user':47B,101C 'wordpress':1A,21B,23B,29B,51B,75C,109C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 are exposed, and the attacker needs any logged-in account, such as a subscriber. Sites without this plugin, or with it already updated to 2.0.0 or later, are not affected. The sources do not say whether registration or default-role settings change the risk beyond the example given.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-121866':13A,16A '-2026':12A,15A 'chang':8A 'cve':11A,14A 'gateway':4A 'ilead':2A 'let':6A 'option':10A 'plugin':5A 'site':9A 'sms':3A 'subscrib':7A 'wordpress':1A","search_b":"'2.0.0':32B 'action':35B 'administr':60B,68B 'ajax':34B 'arbitrari':50B 'attack':54B 'capabl':38B 'chang':49B 'check':41B 'default':63B 'enabl':56B 'escal':66B 'gateway':28B 'host':20B 'ilead':26B 'log':45B 'logged-in':44B 'nonc':40B 'open':57B 'option':52B 'packag':17B 'plugin':24B,30B 'registr':58B 'role':64B 'self':19B 'self-host':18B 'skip':37B 'sms':27B 'user':47B 'wordpress':21B,23B,29B,51B 'wordpress-plugin':22B","search_c":"'2.0.0':78C 'action':88C 'administr':114C,121C 'ajax':87C 'allow':98C 'arbitrari':108C 'authent':100C 'capabl':82C 'chang':107C 'check':81C 'chosen':94C 'default':124C 'enabl':118C 'escal':112C 'exampl':116C 'exsil':74C 'gateway':72C 'ilead':70C 'nonc':84C 'option':93C,110C 'plugin':76C 'registr':119C 'request':97C 'role':125C 'sever':86C 'site':92C 'sms':71C 'subscrib':105C 'updat':90C 'user':101C 'wordpress':75C,109C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121866","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}