CVE-2026-121866
Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
| Vendor | unknown |
| Product | ileads sms gateway by exsile |
| Published | Nov 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ileads sms gateway by exsile
Be the first to know when new unknown vulnerabilities affecting unknown ileads sms gateway by exsile are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / iLeads SMS Gateway by Exsile
0 < 2.0.0
References
Credits
Naoki Kawahigashi WPScan