Jan 15, 2026Ravie LakshmananWeb Safety /Vulnerability
A maximum-severity safety flaw in a WordPress plugin referred to as Modular DS has come underneath lively exploitation within the wild, in line with Patchstack.
The vulnerability, tracked as CVE-2026-23550 (CVSS rating: 10.0), has been described as a case of unauthenticated privilege escalation impacting all variations of the plugin previous to and together with 2.5.1. It has been patched in model 2.5.2. The plugin has greater than 40,000 lively installs.
“In variations 2.5.1 and under, the plugin is susceptible to privilege escalation, as a result of a mix of things together with direct route choice, bypassing of authentication mechanisms, and auto-login as admin,” Patchstack stated.
The issue is rooted in its routing mechanism, which is designed to place sure delicate routes behind an authentication barrier. The plugin exposes its routes underneath the “/api/modular-connector/” prefix.
Nevertheless, it has been discovered that this safety layer could be bypassed each time the “direct request” is enabled by supplying an “origin” parameter set to “mo” and a “kind” parameter set to any worth (e.g., “origin=mo&kind=xxx”). This causes the request to be handled as a Modular direct request.
“Subsequently, as quickly as the positioning has already been linked to Modular (tokens current/renewable), anybody can go the auth middleware: there isn’t a cryptographic hyperlink between the incoming request and Modular itself,” Patchstack defined.
“This exposes a number of routes, together with /login/, /server-information/, /supervisor/, and /backup/, which permit numerous actions to be carried out, starting from distant login to acquiring delicate system or consumer knowledge.”
Because of this loophole, an unauthenticated attacker can exploit the “/login/{modular_request}” path to get administrator entry, leading to privilege escalation. This might then pave the way in which for a full web site compromise, allowing an attacker to introduce malicious adjustments, stage malware, or redirect customers to scams.
In keeping with particulars shared by the WordPress safety firm, assaults exploiting the flaw are stated to have first been detected on January 13, 2026, at round 2 a.m. UTC, with HTTP GET calls to the endpoint “/api/modular-connector/login/” adopted by makes an attempt to create an admin consumer.
The assaults have originated from the next IP addresses –
In gentle of lively exploitation of CVE-2026-23550, customers of the plugin are suggested to replace to a patched model as quickly as attainable.
“This vulnerability highlights how harmful implicit belief in inner request paths could be when uncovered to the general public web,” Patchstack stated.
“On this case, the difficulty was not brought on by a single bug, however by a number of design decisions mixed collectively: URL-based route matching, a permissive ‘direct request’ mode, authentication based mostly solely on the positioning connection state, and a login movement that robotically falls again to an administrator account.”
