Critical WordPress Plugin Backdoor Exposes Site and Admin Details

Key Takeaways

• A critical supply chain compromise impacted the Advanced Responsive Video Embedder WordPress plugin.
• Version 10.8.7 of the plugin contained a backdoor granting unauthenticated attackers full administrator access.
• Approximately 20,000 active installations were affected by the malicious version, identified as CVE-2026-18072 with a CVSS score of 9.8.
• The backdoor was detected swiftly by Wordfence PRISM, and the plugin was removed from the WordPress.org repository.
• Users are urged to update immediately and check for signs of compromise.

Critical Backdoor Discovered in WordPress Plugin

A severe supply chain vulnerability has been uncovered within the Advanced Responsive Video Embedder WordPress plugin, potentially exposing an estimated 20,000 active installations to complete administrative takeover by unauthenticated attackers. The malicious code, present in version 10.8.7, has been assigned CVE-2026-18072 and carries a critical CVSS score of 9.8.

This critical flaw was identified on July 28, 2026, by Wordfence PRISM, an autonomous AI-driven vulnerability intelligence system. The detection occurred less than two hours after the compromised code was introduced, highlighting the speed and efficacy of the security platform. Unlike typical programming vulnerabilities, this incident points to a deliberate compromise within the plugin’s distribution pipeline, rather than an accidental coding error.

Anatomy of the Backdoor

The backdoor is cleverly hidden within a file named php/fn-update-check.php, which the plugin’s main file loads. Its core function, _arve_uc_init(), executes very early in the WordPress request lifecycle, crucially before any standard authentication procedures are performed.

Attackers can trigger the backdoor by supplying a specific value through the _wplogin or _wpm request parameters, which can be delivered via URL, form submission, or a cookie. The malicious code then verifies this supplied value against a hardcoded SHA-256 token embedded directly within the plugin’s source. Since this token is publicly accessible in the distributed code, it acts as a universal key, allowing any attacker to bypass authentication without needing a valid WordPress password, user account, nonce, or prior access.

Upon successful token validation, the backdoor scans for existing administrator accounts and selects one to impersonate. It specifically avoids usernames that start with wpsvc_, developer_, dev_, and wp_update_, suggesting that the orchestrators behind this attack may have intended to preserve their own controlled accounts. Subsequently, the code establishes a persistent WordPress login session for the chosen administrator and redirects the attacker directly to the WordPress admin dashboard.

In addition to granting administrative access, the malware sends the compromised site’s URL and the impersonated administrator username to fontswp.com, an attacker-controlled command-and-control (C2) server. This communication provides the attackers with real-time visibility into successful compromises and allows them to identify potentially high-value targets for further exploitation.

Wordfence emphasized the extreme danger of this vulnerability, noting that exploitation requires only a single, specially crafted HTTP request. Attackers do not need to engage in brute-forcing credentials, trick users into clicking malicious links, or interact with a site administrator. A vulnerable site can be fully compromised within mere seconds.

Response and Mitigation

Wordfence immediately notified the WordPress.org plugin team after confirming the backdoor’s presence. In response, the plugin’s repository was closed for downloads on July 28, 2026.

The WordPress.org team further confirmed that the malicious release had not yet been widely distributed through automatic updates. Nevertheless, organizations utilizing the Advanced Responsive Video Embedder plugin must take immediate action to verify their installed versions and diligently review their sites for any indicators of compromise.

What You Should Do

• Immediately update the Advanced Responsive Video Embedder plugin to a safe version, or deactivate and remove it if an official clean update is not yet available.
• Audit all administrator accounts for suspicious activity or newly created users.
• Invalidate all active WordPress sessions to force re-authentication for all users.
• Rotate WordPress secret keys and reset passwords for all privileged accounts.
• Thoroughly inspect plugin files, themes, and the database for any secondary backdoors, unauthorized code, or database changes.
• Review firewall logs and network traffic for outbound connections to fontswp.com and block this domain at the network perimeter.
• Consider implementing a robust web application firewall (WAF) to detect and block malicious requests targeting known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.