{"id":"CVE-2026-121866","aliases":["EUVD-2026-118949","GHSA-r4wx-vxrq-8xm2"],"status":"published","title":"Exsile SMS Gateway \u003c 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00232,"percentile":0.14198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-11-07T06:00:29Z","modified":"2026-11-07T18:16:14Z","products":[{"vendor":"unknown","product":"ileads sms gateway by exsile"}],"references":[{"url":"https://wpscan.com/vulnerability/b1fca9ef-8839-4030-88ab-c2bcdd79f488/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121866"},{"url":"https://wpscan.com/vulnerability/b1fca9ef-8839-4030-88ab-c2bcdd79f488"},{"url":"https://github.com/advisories/GHSA-r4wx-vxrq-8xm2"}],"sources":{"cve":[{"id":"CVE-2026-121866","title":"Exsile SMS Gateway \u003c 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","status":"published","published":"2026-11-07T06:00:29.219Z","modified":"2026-11-07T18:16:14.492Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-07T19:35:26.456285Z"}],"euvd":[{"id":"EUVD-2026-118949","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","status":"published","published":"2026-11-07T06:00:29Z","modified":"2026-11-07T18:16:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T19:10:17.704886Z"}],"ghsa":[{"id":"GHSA-r4wx-vxrq-8xm2","title":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or...","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","status":"published","published":"2026-11-07T06:31:24Z","modified":"2026-11-07T21:31:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-07T21:39:59.065692Z"}],"nvd":[{"id":"CVE-2026-121866","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","status":"published","published":"2026-11-07T06:16:58.96Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-07T22:06:52.100138Z"}]}}