A severe security issue has been uncovered in the Advanced Responsive Video Embedder plugin for WordPress, endangering approximately 20,000 active installations. This vulnerability, identified as CVE-2026-18072, could grant unauthenticated users complete administrative access, with a CVSS score of 9.8, highlighting its critical nature.
Discovery and Technical Details
The vulnerability was first identified by Wordfence PRISM, an advanced AI-driven vulnerability detection system, on July 28, 2026. It was detected merely hours after the introduction of the malicious code, marking a significant breach in the plugin’s distribution chain.
This backdoor is hidden within a file named php/fn-update-check.php, which the plugin loads automatically. The function _arve_uc_init() executes early during WordPress’s request process, bypassing typical authentication checks. Attackers can exploit this by using specific request parameters to gain access.
Mechanism of the Attack
The attack is facilitated through attacker-supplied parameters that are verified against a visible SHA-256 token in the plugin’s code. This token acts as a universal credential, enabling attackers to bypass the usual security measures without needing any valid WordPress credentials.
Once the token is validated, the backdoor identifies an administrator account to impersonate, deliberately avoiding usernames that could be controlled by the attackers themselves. This leads to the creation of a persistent admin session, granting the attacker access to the WordPress admin dashboard.
The backdoor also communicates with a command-and-control server, fontswp.com, sending details of compromised sites and admin usernames, which helps attackers track and prioritize their targets.
Response and Mitigation Measures
Wordfence promptly informed the WordPress.org plugin team, resulting in the closure of the plugin’s download repository on the same day. Although the malicious version had not been widely distributed via automatic updates, site administrators are urged to verify plugin versions and check for any signs of compromise.
Recommended actions include auditing admin accounts, revoking active sessions, rotating WordPress secret keys, resetting privileged credentials, and examining files and databases for any unauthorized changes. Additionally, blocking outgoing connections to fontswp.com is advised to prevent further unauthorized data transmission.
In light of this incident, it is essential for organizations to strengthen their security operations centers (SOC) by adopting tools like ANY.RUN to accelerate threat detection and response times.
