Loading story…
A malicious supply-chain backdoor was discovered in version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin, tracked as CVE-2026-18072 with a CVSS 9.8 rating. The implanted code introduced an unauthenticated authentication bypass through the _wplogin and _wpm parameters, allowing an attacker to use a hardcoded token from the plugin source to log in as any existing administrator and take full control of a site. The flaw has been classified as CWE-506: Embedded Malicious Code, and reporting indicates the backdoor was likely added after an attacker gained commit access to the developer account.
Wordfence said it detected the malicious release within hours of its introduction and alerted the WordPress.org plugin team, which closed the plugin repository for downloads the same day. Additional reporting said the backdoor also created a persistent admin session, redirected the intruder into the WordPress dashboard, and sent the compromised site URL and impersonated administrator username to attacker-controlled domain fontswp.com. The plugin had roughly 20,000 active installations, although WordPress.org said the malicious version had not been widely distributed through automatic updates; defenders were urged to remove version 10.8.7, install a clean update, and investigate affected sites for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The WordPress.org plugin repository was closed for downloads on July 28, 2026, in response to the malicious release. WordPress.org also said the compromised version had not yet been broadly distributed through automatic updates.
After detecting the malicious code, Wordfence notified the WordPress.org plugin team on July 28, 2026. This escalated the supply-chain incident to the platform maintainers for response.
Wordfence detected the backdoored plugin release on July 28, 2026, identifying the malicious supply-chain compromise within hours of its introduction. The issue affected the Advanced Responsive Video Embedder plugin, which had about 20,000 active installations.
WordPress.org announced a temporary security measure delaying plugin and theme releases by up to 24 hours before distribution through auto-updates. The change, part of the Protect The Shire initiative, was introduced to improve supply-chain security through additional review, including AI-assisted analysis.
Wordfence said it observed active exploitation of the backdoored ARVE 10.8.7 release and blocked 532 attack attempts in a 24-hour period. The activity showed attackers were already trying to use the hardcoded authentication bypass against vulnerable WordPress sites.
A malicious backdoor was introduced into version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin, enabling unauthenticated authentication bypass via hardcoded parameters and token checks. The backdoor also sent the compromised site URL and impersonated administrator username to the attacker-controlled domain fontswp.com.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcethreataft.com
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcewordpress.org
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain attack hit the **Essential Plugin** WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to `Countdown Timer Ultimate` version `2.6.7` in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted `analytics.essentialplugin.com`, received additional payloads, and had malicious code written into `wp-config.php`. The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all **31** Essential Plugin entries in the plugin directory and pushed version `2.6.9.1` to remove the phone-home behavior, but reports warned that the update did **not** clean already-compromised `wp-config.php` files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.
Jun 29, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
A critical authentication-bypass flaw in the **Burst Statistics** WordPress plugin is being actively exploited to seize administrator access on vulnerable sites. Tracked as `CVE-2026-8181`, the bug affects versions `3.4.0` through `3.4.1.1` and was introduced through improper return-value handling in the plugin’s `is_mainwp_authenticated()` logic for Basic Authentication headers. Security researchers reported that an unauthenticated attacker who knows an administrator username can send arbitrary credentials and be treated as that admin for the request, allowing account impersonation or creation of new administrator accounts on sites running the plugin, which is installed on roughly 200,000 WordPress websites. Wordfence said it observed live attacks and blocked more than 7,400 exploitation attempts in a 24-hour period. Successful compromise could enable follow-on activity including data theft, malware deployment, and malicious site redirection. Defenders were urged to update immediately to **Burst Statistics `3.4.2`** or disable the plugin until patching is possible. Separate disclosures also highlighted another severe WordPress plugin issue, `CVE-2026-6510` in **InfusedWoo Pro** `<= 5.1.2`, where missing authorization checks in the `iwar_save_recipe()` AJAX handler can let unauthenticated attackers craft automation-based authentication bypass leading to administrator-level privilege escalation.
Jun 29, 2026