Backdoored WordPress Plugin Advanced Responsive Video Embedder Grants Admin Access via Hardcoded Token
A supply chain attack has compromised the WordPress plugin Advanced Responsive Video Embedder, introducing a backdoor that allows unauthenticated attackers to gain full administrative control using a hardcoded token.
Wordfence PRISM, an autonomous AI vulnerability intelligence agent, detected a critical backdoor in the WordPress plugin Advanced Responsive Video Embedder on July 28th, 2026. The malicious code was introduced less than two hours before detection, highlighting the speed at which such supply chain attacks can compromise widely used software. The plugin, which boasts approximately 20,000 active installations, was found to contain a deliberately concealed function that grants any unauthenticated attacker full administrative access to affected websites.
This is not a typical coding error but a sophisticated supply chain attack, a tactic that has seen a significant rise in prevalence. The backdoor allows attackers to bypass authentication entirely by supplying a single, hardcoded token. Given that exploitation requires no credentials, no user interaction, and only a single HTTP request, any site running the affected version, 10.8.7, should be considered potentially compromised.
Wordfence has responded swiftly by releasing a firewall rule to protect its Premium, Care, and Response users. This protection was deployed on July 28th, 2026. Users of the free Wordfence plugin will receive the same protection 30 days later, on August 27th, 2026. The vulnerability has been assigned CVE-2026-18072 and carries a critical CVSS rating of 9.8.
Due to the nature of the compromise—malicious code injected into a publicly distributed plugin—Wordfence immediately notified the WordPress.org plugin team. The WordPress.org team acknowledged the report and has since removed the plugin from public download. While the malicious version had not yet been widely distributed, users are urged to uninstall Advanced Responsive Video Embedder as a precautionary measure and verify their site's security.
The technical analysis reveals that the backdoor resides in the php/fn-update-check.php file, specifically within the _arve_uc_init() function. This function is registered to run on every request before any authentication checks occur. It reads a token from the _wplogin or _wpm parameter, which can be sent via GET, POST, or cookies. After a basic length check, the token is compared against a hardcoded SHA-256 hash: 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900.
This hardcoded hash acts as a universal master credential. Anyone possessing this token can authenticate as any existing administrator account on the affected WordPress site. The code also attempts to derive a site-specific token using AUTH_KEY and SECURE_AUTH_KEY constants, but it falls back to the static hash, making it universally exploitable. This suggests that an attacker likely gained commit access to the developer's account to inject this malicious code.
The vulnerability, identified as an Unauthenticated Authentication Bypass via Hardcoded Backdoor, affects version 10.8.7 of the Advanced Responsive Video Embedder plugin. The exploit leverages a flaw in how the _arve_uc_init() function processes user-supplied tokens without proper validation, effectively allowing arbitrary administrative access. The presence of a hardcoded SHA-256 hash bypasses all standard authentication mechanisms.
This incident underscores the growing threat of supply chain attacks targeting the vast WordPress ecosystem. Developers and users alike must remain vigilant, employing robust security practices and prompt patching to mitigate risks associated with compromised plugins and themes. The rapid detection and response by Wordfence highlight the importance of automated security tools in identifying and neutralizing threats in near real-time.