Modular DS Reviews

Critical vulnerability in this plugin -

I was using this on just a handful of sites the last year or so. I got an alert that an admin user had been created with an obvious fake email address.

After running through the logs I came across this:
Authentication bypass
03:05:38 45.11.89.19 302 GET /api/modular-connector/login/anything?origin=mo&type=foo
The attacker calls the vulnerable ModularDS endpoint. The 302 response is a redirect — but critically, this redirect includes a valid WordPress authentication cookie. No username or password required.

Admin access confirmed
03:05:38 45.11.89.19 200 GET /wp-admin/index.php
Same second. The attacker accesses the WordPress admin dashboard. The 200 response means success — they're now logged in as an administrator.

Navigating to user creation
03:05:39 45.11.89.19 200 GET /wp-admin/user-new.php
The attacker loads the "Add New User" page. This is an automated script.

Creating the malicious account
03:05:39 45.11.89.19 302 POST /wp-admin/user-new.php
The attacker submits the form to create a new admin account. The 302 redirect indicates the form was processed successfully.

Attack complete
03:05:40 45.11.89.19 200 GET /wp-admin/users.php?update=add&id=10
The attacker is redirected to the users list with update=add&id=10 in the URL. This confirms user ID 10 (the "admin5" account) was successfully created.

Total time from first request to full compromise: 2 seconds.

Attacker attempted to use the new account
About 2 minutes after the account was created, a different IP attempted to log in — likely to use the newly created admin5 credentials:
2026-01-14 03:07:34 Access 151.241.30.63 200 GET /wp-login.php HTTP/1.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1)
2026-01-14 03:07:35 Access 151.241.30.63 200 POST /wp-login.php HTTP/1.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1)

In my case, the attacker only had approximately 90 seconds of access before I responded. A Wordfence scan confirmed no malware or backdoors were installed. However, if this plugin has been on your site for a while, the attacker may have had more time to cause damage.
The vulnerability appears to be an authentication bypass, which is as serious as it gets. Any site with this plugin installed should be considered potentially compromised.

This is a real time saver und it works so flawless! Thanks for such a great piece of software! Now updating dozens of sites is no more a pain in the a## but fun and can be done in less than a view minutes: Themes updates, plugins updates, all in bulk don! And even backups can be run from this command center scheduled with is really easing your mind! Best buy ever!

Been using ModularDS for a while now since purchasing and finding it really valuable and meets all my needs. Thanks!

This is a 5 taco product that worked brilliantly from the beginning to connect WordPress sites, setup backups easily and updates already rolling out from purchase. The reporting feature could be better for visual customisation and being able to create templates and duplicate for setting up new clients without starting from scratch (doesn't save your branding yet but its on the public roadmap woohoo), the actual reporting is clear and thorough, WooCommerce reporting ACTUALLY works too, and excited seeing all the future updates!

I have had zero problems with this tool and it's saved me so much time.

My main use cases are keeping plugins and themes up to date as well as uptime monitoring. It does both, easy peasy.

I haven't tried a backup and restore. I have other apps for that, but I like that it can be done centralized. I'll try that part soon.

I'm very glad I purchased Modular DS.