top of page

Subscribe to our newsletter

CVE-2026-23550: Critical WordPress Modular DS Plugin Vulnerability Actively Exploited for Admin Access

  • Rescana
  • Jan 19
  • 4 min read
Image for post about Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access

Executive Summary

A critical security vulnerability has been identified in the WordPress Modular DS plugin, which is actively being exploited to gain unauthorized administrator access to WordPress sites. This flaw, tracked as CVE-2026-23550 with a maximum CVSS score of 10.0, affects all versions of the Modular DS plugin up to and including 2.5.1. The vulnerability allows unauthenticated remote attackers to bypass authentication controls and escalate privileges, resulting in full site compromise. Attackers are leveraging this flaw in the wild, creating unauthorized admin accounts, deploying malware, and potentially exfiltrating sensitive data. Immediate remediation is required to prevent further exploitation and mitigate the risk of business disruption, data loss, and reputational damage.

Threat Actor Profile

Current exploitation of the Modular DS plugin vulnerability is being conducted by opportunistic cybercriminals rather than advanced persistent threat (APT) groups. The attack pattern is consistent with mass exploitation campaigns targeting widely deployed WordPress plugins. The threat actors are leveraging automated tools to scan for vulnerable endpoints and execute privilege escalation payloads. The observed infrastructure includes IP addresses associated with known malicious activity, and the attackers demonstrate a high level of technical proficiency in exploiting WordPress plugin architecture. While no specific group attribution has been made, the tactics, techniques, and procedures (TTPs) align with those used by cybercriminals seeking to monetize access through ransomware, web shell deployment, or resale of compromised admin credentials.

Technical Analysis of Malware/TTPs

The CVE-2026-23550 vulnerability resides in the custom routing and authentication logic of the Modular DS plugin. The plugin exposes several API endpoints, notably /api/modular-connector/login/, which are intended to be protected by authentication middleware. However, when the "direct request" mode is enabled, an attacker can supply the parameters origin=mo and type=<arbitrary value> to these endpoints. This causes the plugin to treat the request as a trusted Modular direct request, bypassing all authentication checks.

The core technical flaw is the absence of a cryptographic binding between the request and the legitimate Modular service. If the WordPress site is already connected to Modular (i.e., tokens are present and renewable), any unauthenticated user can pass the authentication middleware by crafting a request with the required parameters. The most critical endpoint, /api/modular-connector/login/{modular_request}, allows attackers to trigger the creation of new administrator accounts or escalate existing privileges.

Once admin access is obtained, attackers typically deploy web shells, install malicious plugins, or modify site content to redirect users to phishing or malware distribution sites. The exploitation chain is rapid and can be fully automated, enabling attackers to compromise large numbers of sites in a short timeframe.

Exploitation in the Wild

Active exploitation of the Modular DS plugin vulnerability was first detected on January 13, 2026. Attackers are scanning for WordPress sites with vulnerable plugin versions and issuing HTTP GET requests to the /api/modular-connector/login/ endpoint with the origin=mo parameter. Successful exploitation is immediately followed by the creation of unauthorized admin users, often with generic usernames such as "modular_admin" or "wp_admin2".

Malicious activity has been traced to IP addresses including 45.11.89[.]19 and 185.196.0[.]11, both of which are associated with previous cybercriminal campaigns. The impact of exploitation includes the deployment of backdoors, exfiltration of user databases, and the injection of malicious JavaScript for drive-by downloads or credential harvesting. In some cases, compromised sites have been used as part of larger botnets or for hosting phishing pages.

Security researchers and incident response teams have observed a sharp increase in attack volume, with thousands of exploitation attempts recorded within the first 48 hours of public disclosure. Public proof-of-concept (PoC) exploits are available on security forums and code repositories, further accelerating the rate of compromise.

Victimology and Targeting

The primary victims of this campaign are organizations and individuals operating WordPress sites with the Modular DS plugin version 2.5.1 or earlier. The plugin is widely used, with over 40,000 active installations reported prior to the disclosure. Affected sectors include e-commerce, media, education, and small to medium-sized enterprises (SMEs) that rely on WordPress for web presence and business operations.

Attackers are not targeting specific industries or geographies; rather, they are indiscriminately scanning the internet for vulnerable sites. However, sites with higher traffic or those handling sensitive customer data are at increased risk of secondary exploitation, such as data theft or ransomware deployment. The presence of unauthorized admin accounts, unexpected changes to site content, and anomalous outbound network traffic are key indicators of compromise.

Mitigation and Countermeasures

Immediate action is required to mitigate the risk posed by this vulnerability. All organizations using the Modular DS plugin must upgrade to version 2.5.2 or later, which contains the necessary security patch. Administrators should review all user accounts for unauthorized additions, paying particular attention to new admin users created after January 13, 2026.

Comprehensive log analysis should be conducted to identify suspicious requests to /api/modular-connector/login/ with the origin=mo parameter. If compromise is suspected, it is essential to regenerate all WordPress salts and OAuth credentials to invalidate active sessions and prevent further unauthorized access. A full file system and database scan should be performed to detect and remove any malicious code, plugins, or web shells.

Organizations are advised to implement web application firewalls (WAFs) with custom rules to block access to vulnerable endpoints and monitor for exploitation attempts. Regular plugin updates, least-privilege access controls, and continuous security monitoring are critical components of a robust WordPress security posture.

References

The following resources provide additional technical details and guidance on the Modular DS plugin vulnerability:

About Rescana

Rescana is a leader in third-party risk management (TPRM) and cyber risk intelligence. Our platform empowers organizations to continuously monitor, assess, and mitigate cyber threats across their digital supply chain. By leveraging advanced analytics and real-time threat intelligence, Rescana enables proactive risk reduction and compliance with industry standards. For more information about our TPRM solutions or to discuss your cybersecurity needs, we are happy to answer questions at ops@rescana.com.

bottom of page