Backdoored WordPress Video Embedder Plugin Enabled Admin Takeover

A malicious supply-chain backdoor was discovered in version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin, tracked as CVE-2026-18072 with a CVSS 9.8 rating. The implanted code introduced an unauthenticated authentication bypass through the _wplogin and _wpm parameters, allowing an attacker to use a hardcoded token from the plugin source to log in as any existing administrator and take full control of a site. The flaw has been classified as CWE-506: Embedded Malicious Code, and reporting indicates the backdoor was likely added after an attacker gained commit access to the developer account.

Wordfence said it detected the malicious release within hours of its introduction and alerted the WordPress.org plugin team, which closed the plugin repository for downloads the same day. Additional reporting said the backdoor also created a persistent admin session, redirected the intruder into the WordPress dashboard, and sent the compromised site URL and impersonated administrator username to attacker-controlled domain fontswp.com. The plugin had roughly 20,000 active installations, although WordPress.org said the malicious version had not been widely distributed through automatic updates; defenders were urged to remove version 10.8.7, install a clean update, and investigate affected sites for signs of compromise.