{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23550", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-14T08:36:07.869Z", "datePublished": "2026-01-14T08:44:25.503Z", "dateUpdated": "2026-04-28T16:14:46.839Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "modular-connector", "product": "Modular DS", "vendor": "Modular DS", "versions": [{"changes": [{"at": "2.5.2", "status": "unaffected"}], "lessThanOrEqual": "2.5.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Teemu Saarentaus | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:44:04.318Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.<p>This issue affects Modular DS: from n/a through <= 2.5.1.</p>"}], "value": "Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:46.839Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve"}], "title": "WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T16:38:38.788623Z", "id": "CVE-2026-23550", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T16:39:03.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23550", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T16:38:38.788623Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T16:38:52.618Z"}}], "cna": {"title": "WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Teemu Saarentaus | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Modular DS", "product": "Modular DS", "versions": [{"status": "affected", "changes": [{"at": "2.5.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.5.1"}], "packageName": "modular-connector", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:44:04.318Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.<p>This issue affects Modular DS: from n/a through <= 2.5.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:46.839Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23550", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:14:46.839Z", "dateReserved": "2026-01-14T08:36:07.869Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-14T08:44:25.503Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de privilegios incorrecta en Modular DS permite la escalada de privilegios. Este problema afecta a Modular DS: desde n/a hasta 2.5.1."}], "id": "CVE-2026-23550", "lastModified": "2026-04-23T15:36:39.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-14T09:16:02.520", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T22:34:09.487376+00:00", "value": {"mitigation_remediation": ["Update Modular DS plugin to the latest version, which removes the privilege assignment flaw.", "If an immediate update is not possible, temporarily disable the plugin until a patched version is available.", "Review and audit WordPress user roles and permissions to confirm no unintended administrative rights have been granted during the incident."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the Modular DS WordPress plugin, specifically versions up to and including 2.5.1. All installations of the plugin in this version range are potentially exposed.", "description_and_impact": "An Incorrect Privilege Assignment flaw in the Modular DS WordPress plugin allows an attacker to increase their level of access beyond what is intended. The weakness, identified as CWE\u2011266, can enable an attacker to gain administrative privileges within the WordPress system, compromising confidentiality, integrity, and availability of site content and configuration.", "risk_and_exploitability": "The CVSS score is 10, indicating a critical level of severity. The exploit probability is very low, with an EPSS score of 5%, and the issue is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. An attacker would need some level of access to the WordPress installation, likely through authenticated requests that trigger the plugin\u2019s privilege assignment mechanisms, to elevate their privileges."}}}}, "created": "2026-01-15T08:03:55.730537+00:00", "updated": "2026-04-28T22:45:25.934396+00:00", "vendors": ["modular", "modular$PRODUCT$modular", "wordpress", "wordpress$PRODUCT$wordpress"]}