CVE-2026-3903
Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
| CWE | CWE-352 |
| Vendor | modulards |
| Product | modular ds: monitor, update, and backup multiple websites |
| Published | Mar 11, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for modulards modular ds: monitor, update, and backup multiple websites
Be the first to know when new medium vulnerabilities affecting modulards modular ds: monitor, update, and backup multiple websites are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
modulards / Modular DS: Monitor, update, and backup multiple websites
0 ≤ 2.5.1
References
Credits
Dmitrii Ignatyev