CVE-2026-121866 Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121866?
CVE-2026-121866 is a high-severity vulnerability in Unknown iLeads SMS Gateway by Exsile, published on 7 Nov 2026.
Official description
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
Weakness: CWE-269
Which versions are affected by CVE-2026-121866?
How do I fix CVE-2026-121866?
No fix has been published for CVE-2026-121866 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121866 being exploited?
There is no known exploitation of CVE-2026-121866 in the wild and no public exploit code.
Sources
Also known as GHSA-r4wx-vxrq-8xm2.