CVE-2026-121866
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 07, 2026
Vendor
unknown
Description
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.