Wordfence Finds Critical Backdoor in ARVE WordPress Plugin

A backdoored version 10.8.7 of the ARVE WordPress plugin was released with malicious code granting full admin access via secret token. ~20,000 active installations were at risk before WordPress.org blocked distribution. The attacker likely compromised the developer's account to inject the backdoor and exfiltrate credentials to a C2 server.

CRITICALAdvisoryAug 02, 2026

Action required

Immediately identify and audit any WordPress installations running ARVE plugin version 10.8.7. Force update to the patched version and review admin logs and user accounts for unauthorized access. Check for C2 communication in network logs to IOCs associated with this campaign.

Affected products

ARVE (Advanced Responsive Video Embedder)WordPress.orgWordfence

CVE IDs

CVE-2026-18072

Linked articles

Wordfence Finds Critical Backdoor in ARVE WordPress Plugin

Source links

https://hackread.com/wordfence-critical-backdoor-arve-wordpress-plugin/