A critical supply chain backdoor in the Advanced Responsive Video Embedder WordPress plugin, which can give unauthenticated attackers complete administrator access.
The malicious version, 10.8.7, affects a plugin with roughly 20,000 active installations and is tracked as CVE-2026-18072, with a CVSS score of 9.8.
The issue was detected by Wordfence PRISM, the company’s autonomous AI vulnerability intelligence agent, on July 28, 2026, less than two hours after the malicious code was introduced.
Unlike typical programming vulnerabilities, this incident appears to involve a deliberate compromise of the plugin’s distribution supply chain.
WordPress Plugin Backdoor
The backdoor is concealed in a file named php/fn-update-check.php, which is loaded by the plugin’s main file. Its function, _arve_uc_init(), runs early in WordPress’s request lifecycle, before regular authentication checks.
It accepts an attacker-controlled value through the _wplogin or _wpm request parameters, which can be delivered via a URL, form submission, or cookie. The malicious code checks the supplied value against a hardcoded SHA-256 token embedded in the plugin.
Since the token is publicly visible in the distributed source code, any attacker could use it as a universal credential. No valid WordPress password, user account, nonce, or prior access is required.
After validating the token, the backdoor searches for administrator accounts and selects one for impersonation. It deliberately avoids usernames beginning with wpsvc_, developer_, dev_, and wp_update_, indicating that the operators may have intended to preserve accounts they controlled.
The code then creates a persistent WordPress login session for the selected administrator. It redirects the attacker to the WordPress admin dashboard.
Additionally, the malware sends the affected site’s URL and the selected administrator username to fontswp.com, an attacker-controlled command-and-control server. This provides the operators with visibility into successful compromises and allows them to identify high-value targets.
Wordfence noted that exploitation requires only one crafted HTTP request, making this vulnerability especially dangerous. Attackers do not need to brute-force credentials, trick users into clicking links, or interact with a site administrator. A vulnerable site can be fully compromised in a matter of seconds.
Wordfence immediately notified the WordPress.org plugin team after confirming the backdoor. The repository was closed for downloads on July 28, 2026.
The WordPress.org team also confirmed that the malicious release had not yet been broadly distributed through automatic updates. However, organizations using the plugin should still verify installed versions and review their sites for signs of compromise.
They should audit administrator accounts, invalidate active sessions, rotate WordPress secret keys, reset privileged credentials, and inspect files and databases for secondary backdoors or unauthorized changes. Outbound connections to fontswp.com should also be reviewed and blocked.
