Exploitation Attempts Target Critical Modular DS WordPress Plugin Flaw
Active Exploitation · 2 sources · Updated 3mo ago · First seen Jan 14, 2026
MBSD-SOC reported a rise in March attack activity targeting CVE-2026-23550, a critical authentication-bypass vulnerability in the Modular DS WordPress plugin. The flaw affects versions 2.5.1 and earlier and can allow unauthenticated attackers to gain administrator privileges; it has been assigned a CVSS 10.0 severity rating in the CVE record.
Observed exploit attempts abused requests to the plugin's modular-connector login API, including parameters such as origin=mo and type, in an apparent effort to bypass authentication. MBSD-SOC said many of the attack sources seen during the surge were located in the United States and the United Kingdom, and urged organizations running the plugin to upgrade immediately to version 2.5.2 or later.
