Authorization Bypass in Exsile SMS Gateway Plugin for WordPress
CVE-2026-121866
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
Badges
What is CVE-2026-121866?
The iLeads SMS Gateway plugin for WordPress, prior to version 2.0.0, contains a vulnerability due to insufficient validation for AJAX actions that update site options. This oversight allows any authenticated user, including subscribers, to manipulate WordPress settings without appropriate permissions. Such an exploit can lead to security breaches, enabling users to set the default registration role to administrator and potentially gain elevated access, which can compromise the integrity and security of the WordPress site.
Affected Version(s)
iLeads SMS Gateway by Exsile 0 < 2.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.