Critical WordPress Plugin Vulnerability Exploited in the Wild to Gain Instant Admin Access

A critical unauthenticated privilege escalation vulnerability in the Modular DS WordPress plugin allows attackers to gain instant admin access, with exploitation confirmed in the wild.

Affecting over 40,000 sites, the flaw in versions up to 2.5.1 has prompted urgent patches and mitigations from Patchstack and the vendor.

Modular DS, developed by modulards.com, enables remote management of multiple WordPress sites, including monitoring, updates, and backups.

According to Patchstack, the core issue stems from a flaw in the plugin’s Laravel-like router at /api/modular-connector/. Modulards confirmed to cybersecurityNews that the flaw in the routing logic allowed certain protected routes to be reached before authentication and token validation middleware was applied.

Attackers can trigger “direct request” mode using origin=mo and any type parameter, evading the auth middleware if the site is connected to Modular services.

This exposes protected routes like /login/{modular_request}, where the AuthController auto-logs in as an admin user via getAdminUser() if no user ID is specified.

CVE ID	CVSS v3.1 Score	Severity	Affected Versions	Fixed Version
CVE-2026-23550	10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) ​	Critical	<= 2.5.1	2.5.2

Active Exploitation and IOCs

Attacks began January 13, 2026, around 2 AM UTC, targeting /api/modular-connector/login/ with origin=mo&type=foo. Successful exploits create backdoor admins named like “PoC Admin” with fake emails. Patchstack detected matching attempts post-mitigation deployment.

Attacker IP	Notes
45.11.89[.]19	Initial scans
162.158.123[.]41	Login probes
172.70.176[.]95	Admin creation
172.70.176[.]52	Persistence attempts

Version 2.5.2 removes URL-based route matching, adds a default 404 fallback, and enforces type validation (request, oauth, lb) before binding routes. Patchstack’s mitigation rule automatically blocks exploits.

Modular DS users must update immediately; enable auto-updates for vulnerable plugins. Scan logs for IOCs and revoke suspicious admins. This incident underscores the risks of publicly exposed permissive internal routing and emphasizes the need for cryptographic request validation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.