Loading vulnerability…
Hardcoded authentication backdoor in Advanced Responsive Video Embedder
CVE-2026-18072 is an authentication bypass caused by deliberately embedded malicious code in the Advanced Responsive Video Embedder (ARVE) WordPress plugin. Version 10.8.7 is affected; version 10.8.8 is also reported as affected. The backdoor function _arve_uc_init() runs on the WordPress init hook at priority 1, before normal authentication checks. It accepts a token through the _wplogin or _wpm request parameter and permits authentication using a universal hardcoded SHA-256 value exposed in the plugin source. No nonce verification, capability check, or password validation protects this flow. Successful validation selects an existing eligible administrator account, establishes a persistent authenticated session, and redirects the attacker to the administration dashboard. Compromised developer commit access is suspected as the introduction mechanism but has not been established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can obtain full administrative control of an affected WordPress site. This permits access to site data, modification of content and configuration, installation of plugins and themes, and creation of additional administrator accounts. The backdoor also transmits the site's URL and selected administrator username to attacker-controlled infrastructure. Persistent login cookies extend unauthorized access beyond the initial request. Successful proof-of-concept exploitation is confirmed, but claims concerning observed exploitation in the wild conflict.
If you can’t patch tonight, do this now.
Disable the affected plugin pending verified removal or replacement. Apply the protective Wordfence firewall rule where available and block requests containing the backdoor's _wplogin or _wpm parameters. Review request logs and administrator activity, and monitor or restrict outbound connections to the backdoor's callback infrastructure. Request filtering and outbound blocking are defense-in-depth measures, not substitutes for removing the malicious code and investigating compromise.
Patch, then assume compromise.
Immediately remove the backdoored plugin. Version 10.9.0 is reported as patched, whereas earlier advisories list the issue as unpatched; verify release authenticity and that the malicious code has been removed before reinstalling or upgrading. Treat any site that executed the backdoored code as potentially fully compromised. Audit administrator accounts, invalidate all sessions, rotate WordPress secret keys and privileged credentials, and inspect site files and databases for secondary backdoors or unauthorized changes. Updating the plugin alone does not remove persistence established through prior exploitation.
No public exploits tracked yet. Mallory keeps watching.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.