WordPress Plugin Privilege Escalation via Unprotected AJAX Actions

The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The iLeads SMS Gateway plugin for WordPress contains a critical privilege escalation vulnerability stemming from improper access control on AJAX endpoints. By failing to validate user capabilities and nonces, the plugin allows any authenticated user—even those with minimal permissions like subscribers—to modify arbitrary WordPress options. An attacker can exploit this to change the default user registration role to administrator, instantly gaining full site control. This vulnerability affects any WordPress installation running the vulnerable plugin versions, with particular risk to multi-user sites where subscriber accounts are distributed or compromised.

Casky.ai's 224 mapped skills detect the attack patterns associated with this vulnerability through MITRE ATT&CK technique TA0004 (Privilege Escalation). Using Claude AI's extended reasoning, practitioners would observe detection signals including: unauthorized modifications to wp_options table entries, AJAX requests lacking proper nonce validation, capability checks bypassed by low-privileged users, and sudden role changes assigning administrator privileges to subscriber accounts. A Casky analysis would flag the absence of required WordPress security functions (wp_verify_nonce, current_user_can) in plugin code, anomalous option updates originating from unexpected user roles, and suspicious POST requests to admin-ajax.php from non-privileged contexts—patterns that reveal the escalation chain before an attacker achieves full compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-121866.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-121866

Casky has 224 skills that investigate the attack patterns behind CVE-2026-121866. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn