A critical authentication bypass vulnerability in the Modular DS WordPress plugin is being actively exploited, allowing attackers to gain admin-level access to vulnerable sites.
Vulnerability Details
- CVE ID: CVE-2026-23550
- Severity: Maximum (Critical)
- Affected versions: 2.5.1 and older
- Plugin installs: ~40,000 sites
- Discovery: Patchstack researchers, first attacks detected January 13, 2026
Root cause:
- When “direct request” mode is enabled, the plugin accepts requests as trusted without cryptographic validation.
- Sensitive routes are exposed, triggering an automatic admin login fallback.
- If no user ID is provided, the plugin defaults to logging in as an existing admin or super admin.
Exploitation in the Wild
- Attacks began January 13, 2026, 02:00 UTC.
- Exploit allows immediate privilege escalation for unauthenticated users.
- Actively abused to compromise WordPress sites.
Patch & Fix
- Fixed in version 2.5.2 (released within hours of disclosure).
- Changes include:
- Removal of URL-based route matching.
- Use of validated filter logic.
- Default 404 route for unrecognized requests.
- Safe failure mode for invalid inputs.
Recommendations for Site Owners
- Upgrade immediately to Modular DS v2.5.2 or later.
- Review server access logs for suspicious requests.
- Check admin accounts for rogue additions.
- Regenerate WordPress salts after updating.
- Monitor for anomalies in user activity and site configuration.
Takeaway
This flaw highlights the risks of centralized management plugins: while they simplify administration, they also expand the attack surface. With active exploitation already underway, patching is urgent to prevent site takeovers and data breaches.
Leave a Reply