Unrated severityNVD Advisory· Published Nov 7, 2026
CVE-2026-121866
CVE-2026-121866
Description
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.0.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.