CVE-2026-23550
Published: 14 January 2026
Summary
CVE-2026-23550 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-23550 is an Incorrect Privilege Assignment vulnerability, tracked as CWE-266, in the Modular DS modular-connector WordPress plugin. It affects all versions through 2.5.1 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction that can fully compromise confidentiality, integrity, and availability.
An unauthenticated attacker can send crafted requests to the plugin endpoint and escalate privileges on the affected WordPress site, obtaining administrative control without prior access.
The Patchstack advisory for the modular-connector plugin documents the issue and is the primary public reference for affected deployments.
EPSS for the CVE rose from lower values after the January 2026 disclosure to a peak of 0.0810 on 2026-02-18 before receding to the current 0.0452, indicating a measurable increase in observed exploitation interest following publication.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2436
Vulnerability details
Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress plugin (T1190) to achieve privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks on plugin endpoints so unauthenticated requests cannot obtain administrative privileges via incorrect assignment.
Requires that only the minimum necessary privileges are assigned to the modular-connector code paths, eliminating the CWE-266 flaw that allows full admin escalation.
Mandates proper account and privilege provisioning processes that would have prevented the plugin from exposing unrestricted privilege-escalation functions.