002

A critical unauthenticated privilege-escalation flaw (CVE-2026-23550, CVSS 10.0) in the Modular DS WordPress plugin (<=2.5.1, ~40k installs) has been actively exploited to obtain administrator access via the /api/modular-connector/ endpoints when 'direct request' mode and crafted origin/type parameters are used; attacks were observed on Jan 13, 2026 with IP indicators and users are urged to update to 2.5.2 and scan for compromise.