Actively exploited critical flaw in Modular DS WordPress plugin enables admin takeover

A critical vulnerability in the Modular DS WordPress plugin, tracked as CVE-2026-23550, is actively being exploited, with a CVSS score of 10, potentially allowing unauthenticated privilege escalation. The flaw affects plugin versions 2.5.1 and earlier, enabling attackers to escalate privileges by abusing direct route access and bypassing authentication checks to trigger admin login.

According to Patchstack, the plugin exposes API routes under /api/modular-connector/ that are protected by an auth middleware, but authentication can be bypassed via a flawed isDirectRequest() check, allowing access to routes such as login and backup once a site is connected to Modular. Security researchers report attacks began on 13 January 2026, targeting the login API to gain admin access and create new admin users, with activity traced to two known IP addresses: 45.11.89[.]19 and 185.196.0[.]11.

The issue was fixed in version 2.5.2, which removed URL-based route matching, added a default 404 route, and restricted route binding to recognised request types. Users are urged to update to the fixed version to stay protected.