A maximum-severity safety flaw in a WordPress plugin referred to as Modular DS has come beneath lively exploitation within the wild, in keeping with Patchstack.
The vulnerability, tracked as CVE-2026-23550 (CVSS rating: 10.0), has been described as a case of unauthenticated privilege escalation impacting all variations of the plugin previous to and together with 2.5.1. It has been patched in model 2.5.2. The plugin has greater than 40,000 lively installs.
“In variations 2.5.1 and beneath, the plugin is weak to privilege escalation, resulting from a mix of things together with direct route choice, bypassing of authentication mechanisms, and auto-login as admin,” Patchstack mentioned.
The issue is rooted in its routing mechanism, which is designed to place sure delicate routes behind an authentication barrier. The plugin exposes its routes beneath the “/api/modular-connector/” prefix.
Nevertheless, it has been discovered that this safety layer may be bypassed each time the “direct request” is enabled by supplying an “origin” parameter set to “mo” and a “kind” parameter set to any worth (e.g., “origin=mo&kind=xxx”). This causes the request to be handled as a Modular direct request.
“Subsequently, as quickly as the location has already been related to Modular (tokens current/renewable), anybody can cross the auth middleware: there is no such thing as a cryptographic hyperlink between the incoming request and Modular itself,” Patchstack defined.
“This exposes a number of routes, together with /login/, /server-information/, /supervisor/, and /backup/, which permit numerous actions to be carried out, starting from distant login to acquiring delicate system or consumer information.”
On account of this loophole, an unauthenticated attacker can exploit the “/login/{modular_request}” path to get administrator entry, leading to privilege escalation. This might then pave the way in which for a full web site compromise, allowing an attacker to introduce malicious adjustments, stage malware, or redirect customers to scams.
In keeping with particulars shared by the WordPress safety firm, assaults exploiting the flaw are mentioned to have been first detected on January 13, 2026, at round 2 a.m. UTC, with HTTP GET calls to the endpoint “/api/modular-connector/login/” adopted by makes an attempt to create an admin consumer.
The assaults have originated from the next IP addresses –
In gentle of lively exploitation of CVE-2026-23550, customers of the plugin are suggested to replace to a patched model as quickly as doable.
“This vulnerability highlights how harmful implicit belief in inside request paths may be when uncovered to the general public web,” Patchstack mentioned.
“On this case, the problem was not attributable to a single bug, however by a number of design selections mixed collectively: URL-based route matching, a permissive ‘direct request’ mode, authentication primarily based solely on the location connection state, and a login circulation that routinely falls again to an administrator account.”
