Hackers exploit WordPress plugin security flaw exposing 40000 websites

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical WordPress Plugin Flaw Exposes 40,000 Websites to Attack A critical security flaw (CVE-2026-23550) in the Modular DS WordPress plugin has been identified, allowing attackers to bypass admin controls. Discovered by Patchstack, the vulnerability has a severity score of 10/10 and is actively being exploited, affecting approximately 40,000 websites. 9 sources 36