Loading story…
MBSD-SOC reported a rise in March attack activity targeting CVE-2026-23550, a critical authentication-bypass vulnerability in the Modular DS WordPress plugin. The flaw affects versions 2.5.1 and earlier and can allow unauthenticated attackers to gain administrator privileges; it has been assigned a CVSS 10.0 severity rating in the CVE record.
Observed exploit attempts abused requests to the plugin's modular-connector login API, including parameters such as origin=mo and type, in an apparent effort to bypass authentication. MBSD-SOC said many of the attack sources seen during the surge were located in the United States and the United Kingdom, and urged organizations running the plugin to upgrade immediately to version 2.5.2 or later.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported an increase in attacks during March 2026 targeting CVE-2026-23550 in the Modular DS WordPress plugin. The observed exploit traffic attempted authentication bypass via the modular-connector login API using parameters such as "origin=mo" and "type".
MBSD-SOC reported that it had tracked detections of attacks targeting CVE-2026-23550 from February 2026 onward. In February, observed attack-source countries included Germany, Japan, the United States, Australia, and Egypt.
CVE-2026-23550 was publicly disclosed on January 14, 2026. The flaw affects Modular DS WordPress plugin versions 2.5.1 and earlier and can allow unauthenticated attackers to obtain administrator privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical unauthenticated privilege-escalation vulnerability** in the *Modular DS* WordPress plugin is being **actively exploited in the wild** to obtain administrator access. The flaw, tracked as **CVE-2026-23550** (CVSS **10.0**), affects *all versions up to and including 2.5.1* and is fixed in **2.5.2**; the plugin is reported to have **40,000+ active installs**. The issue stems from the plugin’s routing/authentication design under the ` /api/modular-connector/ ` prefix, where attackers can bypass authentication middleware by forcing “direct request” handling using parameters such as `origin=mo` and an arbitrary `type` value, particularly when the site is already connected to Modular services (i.e., tokens are present/renewable). Exploitation leverages exposed routes including ` /login/ ` (notably ` /api/modular-connector/login/ ` / ` /login/{modular_request} `), enabling auto-login behavior that results in **administrator-level access** and potential full site compromise (e.g., data access, backups, management actions, and follow-on malware/persistence). Reporting also notes observed attacker behavior and indicators tied to exploitation attempts against the login endpoint (e.g., requests containing `origin=mo&type=foo`) and lists IPs associated with scanning and post-exploitation activity, including `45.11.89[.]19`, `162.158.123[.]41`, `172.70.176[.]95`, and `172.70.176[.]52`. Patch guidance emphasizes immediate upgrade to **2.5.2**, and mitigations include rules intended to block exploit patterns and hardening changes such as stricter route binding and `type` validation.
Jun 29, 2026
**CVE-2026-23800** is a **critical (CVSS 10.0)** *CWE-266 Incorrect Privilege Assignment* vulnerability in **Modular DS**’s `modular-connector` component affecting versions **2.5.2 up to (but not including) 2.6.0**. The issue is described as enabling **remote privilege escalation** with **no authentication** and **no user interaction** required (AV:N/AC:L/PR:N/UI:N, with **scope change**), with potential for full impact to **confidentiality, integrity, and availability**. Public tracking pages also reference external records (e.g., NVD) and third-party writeups (e.g., Patchstack) for additional context and remediation guidance. Threat-intelligence commentary notes that, despite the severity and apparent ease of exploitation, **no public exploits were reported as available at the time of disclosure**, increasing the importance of rapid patching/upgrade planning and monitoring for exploitation attempts. Other items in the provided material—such as a Rapid7 *Metasploit* weekly wrap-up covering unrelated modules and a separate Android-related information disclosure CVE—do not describe this Modular DS vulnerability and should not be treated as part of the same incident narrative.
Jul 12, 2026
Attackers are actively exploiting two critical authentication bypass flaws in the **miniOrange SAML 2.0 Single Sign On** plugin for WordPress, allowing forged SAML responses to grant **administrator access** on vulnerable sites. The bugs, tracked as `CVE-2026-61979` and `CVE-2026-15981`, can be chained so the plugin accepts attacker-controlled authentication data by misusing an IdP RSA public key as a shared secret and treating an OpenSSL verification error as a valid signature check. Security reporting says exploitation attempts and opportunistic scanning are already underway, with one August incident involving a suspicious WordPress admin session that DigitalOcean linked to exploitation of the Standard edition plugin version `16.1.9`. Although fixes were released in July, the vendor advisory reportedly covered only the free edition, leaving many paid-edition customers unaware because those versions do not display update warnings in the WordPress dashboard; organizations using identity providers such as **Microsoft Entra ID**, **Okta**, and **Google Workspace** may remain exposed if they have not manually upgraded, especially now that a public proof-of-concept is available.
Aug 25, 2026