iLeads SMS Gateway by Exsile
iLeads SMS Gateway by Exsile has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 6.3, and the most serious one scores 6.3 out of 10.
The most common weakness is Improper Privilege Management, behind 1 of the records (100%).
The one issue recorded for iLeads SMS Gateway by Exsile has a vendor fix available, so running the current release closes it.
All of these findings were reported by Naoki Kawahigashi. iLeads SMS Gateway by Exsile is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-121866Exsile SMS Gateway <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation
Read the full analysisVulnerability Records

iLeads SMS Gateway by Exsile
Author
Exsile
iLeads SMS Gateway (by Exsile Digital) sends you an SMS the moment a form is submitted or an order changes status, and can send an automatic SMS to your customer. Forms Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and JetFormBuilder. All forms on the site are listed in one place. Turn a form off, or set different numbers or a different customer message per form. The customer’s mobile is detected automatically from the phone field. Messages are sent after the visitor already got the form response, so forms never wait and never fail because of SMS. WooCommerce SMS per order status – to you, to the customer, or both. Notes to customer can also be sent by SMS. More SMS verification code at login for the roles you choose. Dynamic phone number replacement by traffic source (Google, Facebook, TikTok…), including WhatsApp links. Sender number verification from the settings screen. Activity log of the last 200 events (14 days) in its own tab, with phone numbers partly hidden. Character counter for every message. Works with Israeli mobile numbers only. iLeads website · Plans and pricing · Documentation External services This plugin connects to the iLeads SMS service, operated by Exsile Digital, to send messages. It is used only after you enter your API key. SMS API – https://api.ileads.co.il/api. Data sent: your API key (or an older API token) and username, the sender number, the recipient numbers and the message text; for login verification, the user’s mobile number and the code entered. Sent when a form is submitted, an order status changes, a login code is requested, or you use the “Check settings” / sender verification buttons. Phone replacement script – https://connect.ileads.co.il/v1/phone-replacer.js, loaded on your site’s pages only when phone replacement is turned on. It runs in the visitor’s browser and does not send data. A bundled copy is used if it cannot load. Terms of use · Privacy policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C