Wordfence Finds Critical Backdoor in ARVE WordPress Plugin

Summary

A backdoored version 10.8.7 of the Advanced Responsive Video Embedder (ARVE) WordPress plugin was discovered by Wordfence, containing malicious code that could grant full administrator access through a single secret token. The vulnerability (CVE-2026-18072, CVSS 9.8) was detected within two hours of release and blocked by WordPress.org before automatic distribution to the plugin's ~20,000 active installations. The attacker likely gained commit access to the developer's account to introduce the backdoor, which transmitted compromised credentials to an attacker-controlled C2 server.

Full text

Security MalwareWordfence Finds Critical Backdoor in ARVE WordPress Plugin A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites. byWaqasJuly 31, 20262 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Malicious code added to a WordPress video plugin could have granted full administrator access via a single secret token, but the release was caught before it reached users via WordPress.org automatic updates. The impacted plugin, called Advanced Responsive Video Embedder (ARVE), helps websites add videos from YouTube, Vimeo, Rumble and other services, and has about 20,000 active installations. On July 28, Wordfence’s autonomous PRISM system flagged the code less than two hours after its introduction. The company identified the affected release as version 10.8.7, registered as CVE-2026-18072, and rated it critical with a CVSS score of 9.8 out of 10. Wordfence said the code was likely introduced by an attacker who had gained commit access to the developer’s account. The company’s vulnerability record lists the release as unpatched. Buried inside a file named php/fn-update-check.php, the backdoor appeared designed to pass as routine plugin update code. Its main function was registered on the WordPress init hook with priority 1, allowing it to run before normal authentication checks whenever the website received a request. An attacker who supplied the expected value through request parameters named _wplogin or _wpm could be logged in as an existing administrator. The value was compared with a fixed SHA256 string embedded in the publicly available plugin source, effectively making it a universal credential. No password, account, user action, or brute force attempt was required. A successful request caused the code to select an administrator account, create a persistent login cookie, and send the attacker directly to the WordPress dashboard. The website address and selected administrator’s username were also transmitted to fontswp.com, which Wordfence described as an attacker-controlled command-and-control server. By 11:09 a.m., WordPress.org had closed the plugin for downloads. Wordfence’s timeline says the code was introduced at 8:42 a.m., detected at 10:33 a.m. and verified by its researchers ten minutes later. Although ARVE had about 20,000 active installations, WordPress.org told Wordfence that version 10.8.7 had not yet been distributed. WordPress introduced a delay of up to 24 hours for new plugin and theme releases in June, providing time for automated scanning and human review before automatic updates are sent to websites. Ordinary automatic updates therefore should not have installed the backdoored release. ARVE developer Nicolas Jonas said the malicious release never reached users through WordPress.org and questioned Wordfence’s advice to remove the plugin. Wordfence replied that manually installed copies or updates obtained from third parties could still contain version 10.8.7, while the plugin remained compromised and unavailable from the official repository. Sites found running version 10.8.7 should remove it, review administrator accounts, invalidate active sessions, rotate WordPress secret keys, and inspect files and database records for unauthorized changes. Wordfence issued a firewall rule to its paid users on July 28, while users of its free service are scheduled to receive the same protection on August 27. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts ARVEbackdoorCybersecurityMalwarePluginsecurityVulnerabilityWordfence Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Apple News Malware Surveillance Snake Malware Modified; OS X The Next Target The security researchers at Fox-IT have discovered a modified version of the previously known snake malware. A version… byJahanzaib Hassan Read More Cyber Attacks Cyber Crime Security Hackers Behind ProtonMail Attacks Now Targeting Greek Banks for Bitcoins A hacking group (Armada Collective) which was previously held responsible for launching DDoS attacks on ProtonMail is back… byPushpa Mishra Read More Security The Future of Wi-Fi Security: Assessing Vulnerabilities in WPA3 A new study by researchers Matty Vanhoef and Eyal Ronen revealed five vulnerabilities – collectively named ‘Dragonblood’ –… byWilliam Chalk Read More Security Malware Privacy Flight Sim Lab installed Chrome passwords stealer in piracy check tool Flight Simulator Lab is caught secretly installing a software which steals Chrome passwords from the browser while checking… byWaqas

Indicators of Compromise

• cve — CVE-2026-18072
• domain — fontswp.com
• malware — ARVE WordPress Plugin v10.8.7 backdoor

Entities