CVE-2026-23550

The Modular DS (modular-connector) WordPress plugin contains an incorrect privilege assignment flaw (CWE-266) that allows privilege escalation and is rated critical at CVSS 9.8. Per the CVSS vector, the flaw is exploitable over a network with low attack complexity, no privileges required, and no user interaction, meaning a remote attacker can trigger it against any site running an affected version. Successful exploitation grants the attacker administrator-level access to the WordPress site, effectively a full admin takeover with high impact on confidentiality, integrity, and availability. Any WordPress site running Modular DS in versions up to and including 2.5.1 is affected. Security news reports indicate the flaw is being actively exploited in the wild to gain admin access, and EPSS assigns a 21.1% probability of exploitation within 30 days (97th percentile), though the flaw is not yet listed in CISA's KEV catalog.

What to do: Update the Modular DS connector plugin to the latest patched release (any version after 2.5.1) immediately, since the flaw is being actively exploited. Because successful exploitation grants full administrator access, audit affected sites for unexpected administrator accounts, altered user roles, and suspicious recent admin activity, and treat vulnerable installs as potentially compromised. If patching is not immediately possible, deactivate the plugin until the fixed version can be deployed.