Exploited in the Wild: Critical Modular DS Flaw CVE-2026-23550 (CVSS 10) Allows Instant Admin Takeover

A critical CVE-2026-23550 privilege escalation in the Modular DS WordPress plugin (≤2.5.1) enables unauthenticated attackers to bypass authentication by supplying ?origin=mo (and type), permitting administrative account creation and backdoor installation; active exploitation targeting ~40,000 sites was observed from January 13 onward, IOCs (e.g., 45.11.89.19, 162.158.123.41) are reported, and the vendor has released a patch that refactors routing/auth checks to mitigate the issue.