Critical Word Press Modular DS Plugin Flaw Actively Exploited to Gain Admin Access
Summary: Patchstack reports active exploitation of CVE-2026-23550, a CVSS 10.0 unauthenticated privilege escalation in the WordPress plugin Modular DS affecting all versions up to and including 2.5.1 and patched in 2.5.2, which has more than 40,000 active installs. The flaw lets an attacker bypass the plugin's authentication middleware by sending an "origin=mo" and "type" parameter to routes under "/api/modular-connector/", then use the "/login/{modular_request}" route to gain administrator access; attacks were first detected on January 13, 2026, around 2 a.m. UTC via HTTP GET calls to "/api/modular-connector/login/" followed by attempts to create an admin user.
What you should know: With 40,000-plus installs and a public exploit path that needs no credentials, an attacker who reaches the login route can mint an administrator account and from there stage malware or redirect users to scams - and Patchstack notes the root cause was not one bug but several design choices, including authentication based only on the site's connection state.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-23550
- Related
- ⚡ Weekly Recap: Fortinet Exploits, Red Line Clipjack, NTLM Crack, Copilot Attack & More Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026