Critical WordPress Plugin Vulnerability Exploited in the Wild to Gain Instant Admin Access
A critical unauthenticated privilege escalation vulnerability has been identified in the Modular DS WordPress plugin, allowing attackers to gain admin access. This vulnerability has been exploited in the wild.
A critical unauthenticated privilege escalation vulnerability has been identified in the Modular DS WordPress plugin, allowing attackers to gain admin access. This vulnerability has been exploited in the wild.
The flaw impacts over 40,000 websites and affects plugin versions up to 2.5.1. Urgent patches have been issued by Patchstack and the vendor.
Modular DS, developed by modulards.com, facilitates the remote management of multiple WordPress sites. This includes functionalities such as monitoring, updates, and backups.
The root of the issue lies in a flaw within the plugin's Laravel-like router at /api/modular-connector/ . Attackers can exploit the "direct request" mode using origin=mo and any type parameter, bypassing authentication middleware if the site is linked to Modular services.
This vulnerability exposes protected routes like /login/{modular_request} , where the AuthController auto-logs in as an admin user through getAdminUser() if no user ID is specified. There are no signatures, secrets, or IP checks to validate requests, leading to potential full compromise through actions such as cache clearing, backups, or plugin installations.
CVE ID CVSS v3.1 Score Severity Affected Versions Fixed Version
The flaw impacts over 40,000 websites and affects plugin versions up to 2.5.1.
CVE-2026-23550 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Critical <= 2.5.1 2.5.2
Exploitation activities commenced on Fri, Jan 13, 2026, around 2 AM UTC, targeting /api/modular-connector/login/ with origin=mo&type=foo . Successful exploits result in the creation of backdoor admin accounts with names such as "PoC Admin" and fake emails. Patchstack has detected similar attempts following the deployment of mitigation measures.
Attacker IP Notes
45.11.89[.]19 Initial scans
162.158.123[.]41 Login probes
172.70.176[.]95 Admin creation
172.70.176[.]52 Persistence attempts
Version 2.5.2 introduces URL-based route matching removal, a default 404 fallback, and enforces type validation (request, oauth, lb) before route binding. Patchstack's mitigation rule automatically blocks these exploits.
Users of Modular DS are advised to update immediately and enable auto-updates for vulnerable plugins. It is also recommended to scan logs for Indicators of Compromise (IOCs) and revoke any suspicious admin accounts. This incident highlights the importance of cryptographic request validation and the risks associated with publicly exposed permissive internal routing.
Based on reporting by Cyber Security News.