CVE-2026-121866: Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit the affected AJAX actions, including users with only the Subscriber role. An attacker must first have valid access to an account on the site.

Q: Is a default installation affected?

The affected plugin versions expose AJAX actions that lack capability and nonce checks. Exploitation can allow arbitrary WordPress option changes, including changing registration settings so new accounts receive the Administrator role.

Q: What should be done if the plugin cannot be updated immediately?

Prevent untrusted users from retaining authenticated accounts where possible, especially Subscriber accounts. Review WordPress registration and default-role settings for unexpected changes and correct any configuration that permits administrator-level registration.

Q: How can I check for signs of exploitation?

Review WordPress options related to user registration and the default role, particularly whether registration has been enabled and whether the default role has been changed to Administrator. Also investigate unexpected administrator accounts created after those settings changed.

Published Nov 7, 2026

Updated

The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Exsile iLeads SMS Gateway to a version that resolves this vulnerability.
Fixed in 2.0.0

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit the affected AJAX actions, including users with only the Subscriber role. An attacker must first have valid access to an account on the site.

Is a default installation affected?

The affected plugin versions expose AJAX actions that lack capability and nonce checks. Exploitation can allow arbitrary WordPress option changes, including changing registration settings so new accounts receive the Administrator role.

What should be done if the plugin cannot be updated immediately?

Prevent untrusted users from retaining authenticated accounts where possible, especially Subscriber accounts. Review WordPress registration and default-role settings for unexpected changes and correct any configuration that permits administrator-level registration.

How can I check for signs of exploitation?

Review WordPress options related to user registration and the default role, particularly whether registration has been enabled and whether the default role has been changed to Administrator. Also investigate unexpected administrator accounts created after those settings changed.

CVE-2026-121866: Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Is a default installation affected?

What should be done if the plugin cannot be updated immediately?

How can I check for signs of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is a default installation affected?

What should be done if the plugin cannot be updated immediately?

How can I check for signs of exploitation?