A highly severe backdoor (CVE-2026-18072) has been discovered in version 10.8.7 of the WordPress plugin 'Advanced Responsive Video Embedder (ARVE)'. This vulnerability allows an unauthenticated attacker to gain full administrator access to a WordPress site by simply using a single hardcoded token. The CVSS score is rated at 9.8 (CRITICAL), and with approximately 20,000 active installations potentially affected, immediate action is required.
Immediate Actions to Take
- ✓If the Advanced Responsive Video Embedder (ARVE) plugin is installed, immediately deactivate and delete it from your WordPress admin dashboard.
- ✓Check your WordPress site for any suspicious administrator accounts or file changes, especially reviewing recent change logs.
- ✓Monitor web server, WAF, and WordPress access logs for any unusual access or login attempts.
Vulnerability Overview and Scope of Impact
Version 10.8.7 of the WordPress video embedding plugin 'Advanced Responsive Video Embedder (ARVE)' contains an intentionally embedded authentication bypass backdoor. This malicious code is hidden within the plugin file <code>php/fn-update-check.php</code> and, via specific HTTP request parameters, establishes an administrator login session without authentication by sending a value that matches a publicly disclosed fixed SHA256 string.
According to a Wordfence report, this backdoor code was introduced on July 28, 2026, and was identified within two hours of its introduction by Wordfence's PRISM system. WordPress.org promptly halted downloads of this version before widespread distribution could occur via the automatic update feature. However, sites that manually installed version 10.8.7, or sites where an attacker had already gained commit access to the developer's account, may be exposed to this threat. Given that this plugin has approximately 20,000 active installations, the potential impact is significant.
Specific Impact and Attack Scenarios
This backdoor allows attackers to hijack an administrator session with a single HTTP GET request, requiring no authentication credentials or user interaction. This enables attackers to perform a wide range of malicious operations, including defacing website content, exfiltrating sensitive data, embedding further malware, or taking complete control of the website. With the hijacked administrator session, attackers gain direct access to the WordPress admin dashboard, seizing full control of the site. Wordfence has already deployed firewall rules on July 28, 2026, to protect Wordfence Premium users from known attacks exploiting this vulnerability.
Remediation Steps and Verification Methods
If you are using the Advanced Responsive Video Embedder (ARVE) plugin, immediately deactivate and delete it from your WordPress admin dashboard. Afterward, it is recommended to check the following points:
- ✓In the WordPress admin dashboard, check the 'Users' section to see if any unfamiliar administrator accounts have been created.
- ✓Connect to your server via FTP or SSH and verify the integrity of files within the WordPress root directory, specifically checking for recently modified suspicious files or inconsistencies in <code>wp-config.php</code>, theme, and plugin directories.
- ✓Analyze web server access logs (e.g., Apache's access_log, Nginx's access.log) to investigate for unauthorized requests to paths related to the ARVE plugin (e.g., <code>/wp-content/plugins/advanced-responsive-video-embedder/</code>) or requests containing suspicious parameters.