Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access

A maximum-severity flaw in the WordPress Modular DS plugin, tracked as CVE-2026-23550 with a CVSS of 10.0, has been exploited in the wild, according to Patchstack. The vulnerability causes unauthenticated privilege escalation on all versions up to and including 2.5.1, with a fix available in version 2.5.2, and the plugin is reported to have more than 40,000 active installs.

The root cause lies in the routing mechanism that should guard certain sensitive routes behind authentication; exploits bypass the auth layer by using an origin parameter set to mo and a type parameter with any value, enabling direct Modular requests. Patchstack warned that once a site is connected to Modular, an unauthenticated attacker can target routes such as /login/, /server-information/, /manager/ and /backup/, potentially enabling admin access and paving the way for a full site compromise.

Attacks exploiting CVE-2026-23550 were first detected on 13 January 2026 around 2 a.m. UTC, with HTTP GET calls to /api/modular-connector/login/ attempting to create an admin user, from IPs including 45.11.89[.]19 and 185.196.0[.]11, and users are urged to update to the patched version as soon as possible.