How severe is CVE-2026-23550?

CVE-2026-23550 has a CVSS 3.1 base score of 10 (CRITICAL). EPSS estimates a 21.7% probability of exploitation in the next 30 days.

CVE-2026-23550: WordPress Modular DS plugin <= 2.5.1

Q: What is CVE-2026-23550?

Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.

Description

Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.

Severity

CVSS 3.1 · CNA10 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationnone

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Modular DS	Modular DS	0 to 2.5.1 (fixed ≥ 2.5.2)

References

1 Links

Vulnerability databases

https://patchstack.com/database/Wordpress/Plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve

Record Details

Published

2026-01-14

Last updated

2026-04-28

Assigner (CNA)

Patchstack

Credited to

Teemu Saarentaus | Patchstack Bug Bounty Program

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-266 · Incorrect Privilege Assignment

IAM Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.