CVE-2026-23550
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
Description
Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.
INFO
Published Date :
Jan. 14, 2026, 9:16 a.m.
Last Modified :
Jan. 14, 2026, 9:15 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-23550
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 21595511-bba5-4825-b968-b78d1f9984a3 | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update Modular DS to a version later than 2.5.1.
Public PoC/Exploit Available at Github
CVE-2026-23550 has a 5 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23550.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23550 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23550
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2026-23550
Python
CVE-2026-23550 - Modular DS WordPress Plugin **Unauthenticated Admin Access**
cve-2026-23550 cvss10 cybersecurity poc unauthenticated wordpress wordpress-plugin
Shell
WP Scan helped identify common WordPress vulnerabilities attackers exploit daily.
authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin
cyberdudebivash cyberdudebivashecosystem cybersecurity vulnerability-scanner wordpress-security cve-2026-23550
Python
Red Team Hackery & Web p0wn
PowerShell Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23550 vulnerability anywhere in the article.
-
Daily CyberSecurity
Exploited in the Wild: Critical Ivanti EPMM RCE Flaws (CVSS 9.8) Under Attack
Ivanti has issued an urgent security advisory confirming that attackers are actively exploiting critical vulnerabilities in its Endpoint Manager Mobile (EPMM) solution. The flaws, which allow unauthen ... Read more
-
Daily CyberSecurity
Router Takeover: High-Severity Command Injection Flaw Hits TP-Link Archer MR600
TP-Link has issued a security advisory for its popular Archer MR600 4G+ LTE router, warning of a high-severity vulnerability that could allow attackers to seize control of the device. The flaw, tracke ... Read more
-
Daily CyberSecurity
The AI Throne Reclaimed? Samsung Nears Final NVIDIA “Seal of Approval” for Game-Changing HBM4
Samsung Electronics, which has been laboring to close the yawning chasm in the artificial intelligence memory theater, has finally received promising intelligence. According to reports from Bloomberg ... Read more
-
Daily CyberSecurity
OpenAI’s Big Ad Gamble: Why ChatGPT Ads Cost 3x More Than Meta With Way Less Data
OpenAI is currently orchestrating the strategic integration of advertisements within ChatGPT. Consequently, users of the complimentary tier and the ChatGPT Go subscription will soon encounter promotio ... Read more
-
Daily CyberSecurity
CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps
A critical security vulnerability has been unearthed in vm2, a highly popular sandbox library for Node.js used by millions of developers to run untrusted code. Tracked as CVE-2026-22709, the flaw carr ... Read more
-
Daily CyberSecurity
Incomplete Fix: High-Severity React Server Components DoS Flaw (CVE-2026-23864)
The team behind React, the JavaScript library that powers a vast swath of the modern web, has issued an urgent security advisory warning that previous attempts to patch a Denial of Service (DoS) vulne ... Read more
-
Daily CyberSecurity
High-Severity Flaw in Western Digital Installer Opens Door to Code Execution
Western Digital, a titan in the data storage industry, has rolled out a critical update for its widely used WD Discovery software after security researchers uncovered a dangerous flaw in its installer ... Read more
-
Daily CyberSecurity
Stealth in Script: “PeckBirdy” Framework Powers New Wave of China-Aligned Attacks
A sophisticated new cyberweapon has been spotted in the arsenals of China-aligned Advanced Persistent Threat (APT) groups, marking a significant evolution in how state-sponsored actors evade detection ... Read more
-
Daily CyberSecurity
Under Attack: Microsoft Patches Office Zero-Day (CVE-2026-21509) Exploited in the Wild
Microsoft has rolled out an urgent security update to plug a zero-day hole exploited in attacks in its Office suite that allows attackers to sidestep crucial defenses. The vulnerability, tracked as CV ... Read more
-
Daily CyberSecurity
High-Severity DoS Flaw Hits Google Protocol Buffers (CVE-2026-0994)
A high-severity vulnerability has been discovered in Protocol Buffers (protobuf), Google’s widely used mechanism for serializing structured data. The flaw, tracked as CVE-2026-0994, affects Python imp ... Read more
-
Daily CyberSecurity
“Repo Squatting”: How Hackers Are Using GitHub’s Own Features to Hijack Official Repos
In a clever twist on software supply chain attacks, threat actors are weaponizing a quirk in GitHub’s architecture to distribute malware that appears to come from trusted, official sources. A new repo ... Read more
-
Daily CyberSecurity
“G_Wagon” Malware Hides in Fake NPM UI Library to Steal Cloud Keys
It looked like just another UI library. “ansi-universal-ui” promised to be a “lightweight, modular UI component system for modern web applications.” But behind the professional description and version ... Read more
-
Daily CyberSecurity
Booting Up Malware: Critical Flaw in Rufus Grants Admin Access (CVE-2026-23988)
A high-severity security flaw has been discovered in Rufus, the ubiquitous utility used by millions of IT professionals to format and create bootable USB drives. The vulnerability, tracked as CVE-2026 ... Read more
-
Daily CyberSecurity
“Osiris” Rises: New Ransomware Targets Southeast Asian Food Giant with Advanced Tactics
A new ransomware family, borrowing the name of the ancient Egyptian god of the dead, has emerged in a high-profile attack against a major food service franchisee in Southeast Asia. Dubbed Osiris, this ... Read more
-
Daily CyberSecurity
The Multi-Billion Dollar Suit: Solos Technology Aims to Halt Ray-Ban Meta Sales
Just as Meta appeared to reignite its aspirations for metaverse hardware through its celebrated collaboration with Ray-Ban, the corporation has encountered a formidable legal obstruction. Solos Techno ... Read more
-
Daily CyberSecurity
CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surge
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog with four dangerous new entries, signaling that hackers are actively weaponizi ... Read more
-
Daily CyberSecurity
“New” Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits
Fortinet is investigating a concerning new wave of attacks targeting its network security devices, where threat actors are successfully compromising systems that have already been fully patched agains ... Read more
-
Daily CyberSecurity
Public Yet Private? Critical Appsmith Flaw Exposes Unpublished Actions (CVSS 9.4)
A critical security flaw has been discovered in Appsmith, the popular open-source platform used by organizations worldwide to build internal tools like dashboards and admin panels. The vulnerability, ... Read more
-
Daily CyberSecurity
Sabotage & Exploited in the Wild: Critical Backdoor Found in LA-Studio Element Kit
A critical security incident has rocked the WordPress community after a “backdoor” vulnerability was discovered in the LA-Studio Element Kit for Elementor, a plugin active on over 20,000 websites. The ... Read more
-
Daily CyberSecurity
CVE-2026-22822: Critical Flaw in External Secrets Operator Breaks Namespace Isolation
A critical security vulnerability has been discovered in the External Secrets Operator, a widely used Kubernetes tool that bridges the gap between external secret management systems like AWS Secrets M ... Read more
The following table lists the changes that have been made to the
CVE-2026-23550 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jan. 14, 2026
Action Type Old Value New Value Added Reference https://patchstack.com/articles/critical-privilege-escalation-vulnerability-in-modular-ds-plugin-affecting-40k-sites-exploited-in-the-wild/ -
CVE Modified by [email protected]
Jan. 14, 2026
Action Type Old Value New Value Added Reference https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0/ -
New CVE Received by [email protected]
Jan. 14, 2026
Action Type Old Value New Value Added Description Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-266 Added Reference https://patchstack.com/database/wordpress/plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve