Skip to main content

Critical WordPress Modular DS Plugin Vulnerability Actively Exploited (The Hacker News)

By

Category: Vulnerability / Cybersecurity Advisory

A critical WordPress plugin vulnerability in Modular DS is being actively exploited in the wild, exposing websites to full administrator compromise. This issue was first reported by The Hacker News and verified by security researchers. The flaw, tracked as CVE‑2026‑23550, carries a CVSS score of 10.0, indicating maximum severity and impact.

Scope and Timeline of Activity

The Modular DS plugin — installed on over 40,000 WordPress sites — contains an authentication bypass flaw in all versions up to and including 2.5.1. A patch is available in version 2.5.2, and immediate updates are strongly advised.

Active exploitation was first seen on January 13, 2026, when attackers made HTTP GET requests to the endpoint:

/api/modular-connector/login/

These requests were followed by attempts to create unauthorized admin users on compromised sites.

Known IP addresses observed during attacks include:

  • 45.11.89[.]19

  • 185.196.0[.]11

Technical Characteristics of the Vulnerability

Vulnerability Type: Unauthenticated privilege escalation affecting WordPress plugin routing logic.

How It Works:
The plugin exposes API routes under the /api/modular-connector/ prefix. A security layer was meant to protect sensitive routes, but attackers can bypass this layer by sending a crafted request with:

origin=mo&type=<any_value>

This forces the request to be treated as a direct Modular request, effectively skipping authentication checks.

Exposed Endpoints Include:

  • /login/ – allows administrative login

  • /server-information/ – reveals system data

  • /manager/ – enables management actions

  • /backup/ – offers access to backups
    All of these can be misused by an unauthenticated attacker.

Impact and Risks

An attacker who successfully exploits this flaw can:

  • Create administrator accounts without credentials

  • Deploy malware or backdoors on the site

  • Modify site content or configuration

  • Redirect visitors to malicious pages

Because the exploit works without authentication and bypasses normal security controls, the risk to unpatched websites is extremely high.

Recommended Mitigation and Steps

Immediate actions based on the advisory include:

  1. Update Modular DS to version 2.5.2 or later.

  2. Restrict public access to API routes under /api/modular-connector/.

  3. Audit admin accounts and remove any unexpected or unauthorized users.

  4. Review logs and security monitoring for signs of exploitation.

  5. Harden WordPress deployments following best practices and vendor guidance.

Because attackers are actively scanning the internet for this flaw, updating and auditing affected sites should be treated as an urgent priority.

Final Thoughts

This incident highlights the danger of unprotected internal API endpoints and the importance of keeping plugins up to date. Organizations running WordPress should maintain regular patching and monitoring processes to reduce exposure to similar risks.

At SkelerSecurity (https://www.skelersecurity.com/), we continuously monitor emerging threats and help organizations with incident readiness, vulnerability management, and proactive defense strategies. If your environment includes WordPress sites or internet‑connected infrastructure, ensure you have appropriate visibility and response capabilities.

Source:

Labels:

Comments

Post a Comment

Popular posts from this blog

DVWA CHEAT SHEET

By
“If you’re waiting for permission to break the system, you’re already too late.” What You’re Actually Dealing With DVWA isn’t random vulnerable code. It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it ( edgenexus.io ) Multiple difficulty levels exist for one reason: To show you how weak defenses evolve into real ones. 0. Core Principle You don’t memorize payloads. You understand flow. Input → Application Logic → Output If you control input, you control logic. If you control logic, the rest is just execution. 1. SQL Injection “You don’t bypass authentication. You redefine it.” Break the query ' Error means the application is exposing its internal structure. Take control ' OR '1'='1 # You’re not logging in. You’re forcing the query to return true. Map columns ' ORDER BY 1-- ' ORDER BY 2-- You’re learning how the database thinks. Extract data ' UNION SELECT datab...
Post a Comment
Read more

Greed - Kinnaird CTF

By
Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...
Post a Comment
Read more

Pride - Kinnaird CTF

By
Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...
Post a Comment
Read more