Actively Exploited CVE-2026-23550 in WordPress Modular DS Plugin Enables Unauthenticated Admin Access

A critical unauthenticated privilege-escalation vulnerability in the Modular DS WordPress plugin is being actively exploited in the wild to obtain administrator access. The flaw, tracked as CVE-2026-23550 (CVSS 10.0), affects all versions up to and including 2.5.1 and is fixed in 2.5.2; the plugin is reported to have 40,000+ active installs. The issue stems from the plugin’s routing/authentication design under the /api/modular-connector/ prefix, where attackers can bypass authentication middleware by forcing “direct request” handling using parameters such as origin=mo and an arbitrary type value, particularly when the site is already connected to Modular services (i.e., tokens are present/renewable).

Exploitation leverages exposed routes including /login/ (notably /api/modular-connector/login/ / /login/{modular_request}), enabling auto-login behavior that results in administrator-level access and potential full site compromise (e.g., data access, backups, management actions, and follow-on malware/persistence). Reporting also notes observed attacker behavior and indicators tied to exploitation attempts against the login endpoint (e.g., requests containing origin=mo&type=foo) and lists IPs associated with scanning and post-exploitation activity, including 45.11.89[.]19, 162.158.123[.]41, 172.70.176[.]95, and 172.70.176[.]52. Patch guidance emphasizes immediate upgrade to 2.5.2, and mitigations include rules intended to block exploit patterns and hardening changes such as stricter route binding and type validation.