Malicious code added to a WordPress video plugin could have granted full administrator access via a single secret token, but the release was caught before it reached users via WordPress.org automatic updates.
The impacted plugin, called Advanced Responsive Video Embedder (ARVE), helps websites add videos from YouTube, Vimeo, Rumble and other services, and has about 20,000 active installations.
On July 28, Wordfence’s autonomous PRISM system flagged the code less than two hours after its introduction. The company identified the affected release as version 10.8.7, registered as CVE-2026-18072, and rated it critical with a CVSS score of 9.8 out of 10.
Wordfence said the code was likely introduced by an attacker who had gained commit access to the developer’s account. The company’s vulnerability record lists the release as unpatched.
Buried inside a file named php/fn-update-check.php, the backdoor appeared designed to pass as routine plugin update code. Its main function was registered on the WordPress init hook with priority 1, allowing it to run before normal authentication checks whenever the website received a request.
An attacker who supplied the expected value through request parameters named _wplogin or _wpm could be logged in as an existing administrator. The value was compared with a fixed SHA256 string embedded in the publicly available plugin source, effectively making it a universal credential. No password, account, user action, or brute force attempt was required.
A successful request caused the code to select an administrator account, create a persistent login cookie, and send the attacker directly to the WordPress dashboard. The website address and selected administrator’s username were also transmitted to fontswp.com, which Wordfence described as an attacker-controlled command-and-control server.
By 11:09 a.m., WordPress.org had closed the plugin for downloads. Wordfence’s timeline says the code was introduced at 8:42 a.m., detected at 10:33 a.m. and verified by its researchers ten minutes later.
Although ARVE had about 20,000 active installations, WordPress.org told Wordfence that version 10.8.7 had not yet been distributed. WordPress introduced a delay of up to 24 hours for new plugin and theme releases in June, providing time for automated scanning and human review before automatic updates are sent to websites. Ordinary automatic updates therefore should not have installed the backdoored release.
ARVE developer Nicolas Jonas said the malicious release never reached users through WordPress.org and questioned Wordfence’s advice to remove the plugin. Wordfence replied that manually installed copies or updates obtained from third parties could still contain version 10.8.7, while the plugin remained compromised and unavailable from the official repository.
Sites found running version 10.8.7 should remove it, review administrator accounts, invalidate active sessions, rotate WordPress secret keys, and inspect files and database records for unauthorized changes. Wordfence issued a firewall rule to its paid users on July 28, while users of its free service are scheduled to receive the same protection on August 27.
