Critical Privilege Escalation Flaw in Modular DS WordPress Plugin Exploited in the Wild A severe unauthenticated privilege escalation vulnerability in the Modular DS WordPress plugin has been actively exploited, allowing attackers to gain instant admin access to affected sites. The flaw, tracked as CVE-2026-23550 (CVSS 10.0), impacts over 40,000 sites running versions up to 2.5.1 of the plugin. Developed by modulards.com, Modular DS enables remote management of WordPress sites, including updates, monitoring, and backups. The vulnerability stems from a flaw in the plugin’s Laravel-like router at `/api/modular-connector/`, where certain protected routes could be accessed before authentication and token validation middleware were applied. Attackers exploited this by triggering a "direct request" mode using parameters like `origin=mo` and an arbitrary `type` value, bypassing auth checks. Once exploited, the flaw exposed routes such as `/login/{modular_request}`, where the `AuthController` could auto-log an attacker as an admin via `getAdminUser()` if no user ID was specified. Successful attacks created backdoor admin accounts with names like "PoC Admin" and fake email addresses. Exploitation began on January 13, 2026, around 2 AM UTC, with attackers targeting the `/api/modular-connector/login/` endpoint. Patchstack identified multiple malicious IPs involved in scans, login probes, and admin account creation, including: - 45.11.89[.]19 (Initial scans) - 162.158.123[.]41 (Login probes) - 172.70.176[.]95 (Admin creation) - 172.70.176[.]52 (Persistence attempts) The vendor released version 2.5.2, which mitigates the issue by removing URL-based route matching, enforcing type validation, and adding a default 404 fallback. Patchstack also deployed an automated mitigation rule to block exploits. Users are advised to update immediately and review logs for indicators of compromise (IOCs), including suspicious admin accounts. The incident highlights risks posed by publicly exposed internal routing and underscores the need for stricter request validation in web applications.