CVE-2026-23550criticalobserved exploitationCWE-266

CVE-2026-23550: critical vulnerability in Modular DS

WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

Published · Updated

90Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 10epss 22%
from disclosure to weapon3 days
Published on NVDJan 14
1st PoC+3d
VulnCheckJan 14
exploitation probability
22%top 2% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Modular DS · Modular DS
public PoCs found — 7
githubgithub.com/Cyber-DarkNay/CVE-2026-23550★ 0vulncheckvulncheck.com/xdb/c2e0dca19caaunverifiedvulncheckvulncheck.com/xdb/35a66d599b1eunverifiedvulncheckvulncheck.com/xdb/8b893775d7a1unverifiedvulncheckvulncheck.com/xdb/b4d13fcf3b39unverifiedvulncheckvulncheck.com/xdb/e8b3f5e1a06bunverifiedvulncheckvulncheck.com/xdb/36fb89a64062unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://patchstack.com/database/Wordpress/Plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve