CVE-2026-121866

Summary

The iLeads SMS Gateway WordPress plugin before 2.0.0 lacks capability and nonce checks on AJAX endpoints that update arbitrary site options, enabling any authenticated user—including low-privilege roles like subscriber—to modify critical settings such as default role and registration permissions, thereby escalating privileges to administrator.

Exploitability

Exploitation is straightforward for any authenticated user with minimal privileges (e.g., subscriber) as it requires only sending a crafted AJAX request to vulnerable endpoints without authentication tokens or role verification.

Blast radius

Successful exploitation allows full administrative compromise of the WordPress site, including user creation, plugin/theme modification, and potential lateral movement or data exfiltration.

Detection

Defenders should monitor WordPress debug logs and AJAX request logs for unsanctioned updates to sensitive options (e.g., 'default_role', 'users_can_register') from non-administrative users; look for POST requests to wp-admin/admin-ajax.php with action parameters like ileads_update_option or similar, paired with option names matching privileged settings.

Prioritized remediation

Upgrade to iLeads SMS Gateway plugin version 2.0.0 or later, which implements proper capability checks and nonce validation for affected AJAX actions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.