Modular DS Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Modular DS Connector plugin for WordPress, affecting versions through 2.5.1. This vulnerability arises from incorrect privilege assignment due to overly permissive route matching, which allows unauthenticated attackers to bypass authentication checks and gain elevated privileges on sites running the plugin. Exploitation involves sending specially crafted HTTP requests to login-related endpoints, matching protected routes without proper authentication validation, and potentially gaining administrative access.

Impact

Exploitation of this vulnerability allows an unauthenticated remote attacker to escalate privileges, potentially gaining administrative access on the affected WordPress site.

Remediation

Users of the Modular DS Connector plugin should update to version 2.5.2 or later. After updating, it is recommended to review server access logs for suspicious requests, check for any unfamiliar WordPress admin users, regenerate WordPress salts, and scan the site for malicious plugins or files.