{"id":"CVE-2026-121866","published":"2026-11-07T06:16:58.960","lastModified":"2026-11-10T16:28:46.510","description":"The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b1fca9ef-8839-4030-88ab-c2bcdd79f488/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The iLeads SMS Gateway WordPress plugin before 2.0.0 lacks capability and nonce checks on AJAX endpoints that update arbitrary site options, enabling any authenticated user—including low-privilege roles like subscriber—to modify critical settings such as default role and registration permissions, thereby escalating privileges to administrator.","exploitability":"Exploitation is straightforward for any authenticated user with minimal privileges (e.g., subscriber) as it requires only sending a crafted AJAX request to vulnerable endpoints without authentication tokens or role verification.","blast_radius":"Successful exploitation allows full administrative compromise of the WordPress site, including user creation, plugin/theme modification, and potential lateral movement or data exfiltration.","remediation":"Upgrade to iLeads SMS Gateway plugin version 2.0.0 or later, which implements proper capability checks and nonce validation for affected AJAX actions.","detection":"Defenders should monitor WordPress debug logs and AJAX request logs for unsanctioned updates to sensitive options (e.g., 'default_role', 'users_can_register') from non-administrative users; look for POST requests to wp-admin/admin-ajax.php with action parameters like ileads_update_option or similar, paired with option names matching privileged settings.","tags":["privilege-escalation","auth-bypass","wordpress","ajax-injection","option-tampering"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:52:58.659Z"}}