CVE-2026-18072 Overview
CVE-2026-18072 is an authentication bypass vulnerability in the Advanced Responsive Video Embedder plugin for WordPress, version 10.8.7. The plugin contains a hardcoded backdoor that allows unauthenticated attackers to authenticate as any existing administrator account. The backdoor lives in the _arve_uc_init() function, which runs on the init hook at priority 1 before WordPress performs any authentication checks. The function compares an attacker-supplied token from the _wplogin or _wpm request parameter against a static SHA-256 hash embedded in the plugin source. Because the hash and the matching token are publicly visible in the plugin code, any attacker can supply the token and take over the site.
Critical Impact
Unauthenticated attackers gain full administrator access to any WordPress site running the affected plugin version, enabling complete site takeover.
Affected Products
- Advanced Responsive Video Embedder plugin for WordPress, version 10.8.7
- WordPress sites with the affected plugin installed and activated
- Any hosting environment serving the compromised plugin release
Discovery Timeline
- 2026-07-29 - CVE-2026-18072 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18072
Vulnerability Analysis
The Advanced Responsive Video Embedder plugin registers _arve_uc_init() on the WordPress init hook at priority 1. This placement ensures the function executes on every request before any authentication or authorization checks. The function reads a token from the _wplogin or _wpm HTTP parameter and hashes it with SHA-256. It then compares the resulting hash against a hardcoded string embedded in the plugin source.
When the hash matches, the plugin authenticates the request as an existing administrator selected by the attacker. The flow contains no nonce verification, no capability check, and no password validation. The Wordfence advisory attributes the backdoor to a likely supply-chain compromise of the developer's commit account. This maps to CWE-506: Embedded Malicious Code.
Root Cause
The root cause is a set of universal credentials hardcoded in the plugin's PHP source. Because the source code is publicly distributed through the WordPress plugin repository, the token that produces the matching SHA-256 hash is discoverable through static analysis. Hashing does not protect the credential; it obfuscates it briefly at best.
Attack Vector
An attacker sends an unauthenticated HTTP request to any endpoint of a vulnerable WordPress site with the _wplogin parameter set to the known token. The plugin bootstraps on init, matches the hash, and issues an authenticated session as the chosen administrator. From that session, the attacker can install malicious plugins, modify content, exfiltrate database contents, or drop web shells.
See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the specific source lines implementing the backdoor.
Detection Methods for CVE-2026-18072
Indicators of Compromise
- HTTP requests containing the _wplogin or _wpm query parameter targeting any WordPress endpoint
- Unexpected administrator sessions or session cookies issued without corresponding wp-login.php POST activity
- Newly created administrator accounts, modified user roles, or unexpected plugin and theme installations
- Presence of the advanced-responsive-video-embedder plugin at version 10.8.7 in wp-content/plugins/
Detection Strategies
- Inspect web server access logs for any request containing _wplogin= or _wpm= and treat matches as high-severity events
- Compare installed plugin file hashes against the vendor's clean release hashes to detect the malicious 10.8.7 build
- Alert on WordPress user_login audit events lacking a preceding successful POST to wp-login.php
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized SIEM and build correlation rules for the _wplogin and _wpm parameters
- Monitor file integrity for wp-content/plugins/advanced-responsive-video-embedder/ and alert on any modification
- Track administrator role assignments and plugin installation events in near real time
How to Mitigate CVE-2026-18072
Immediate Actions Required
- Deactivate and remove the Advanced Responsive Video Embedder plugin version 10.8.7 from all WordPress installations
- Rotate all administrator passwords and invalidate active sessions using wp_destroy_all_sessions() or equivalent
- Audit the wp_users and wp_usermeta tables for unauthorized administrator accounts and role changes
- Review installed plugins, themes, and wp-content/uploads/ for web shells or unexpected PHP files
Patch Information
At publication, the referenced advisories identify version 10.8.7 as containing the hardcoded backdoor. Site administrators should remove the affected release and only reinstall the plugin once a clean, verified version is published by the vendor. Confirm the fix status through the Wordfence Vulnerability Report before restoring the plugin.
Workarounds
- Block HTTP requests containing the _wplogin or _wpm parameters at the web application firewall or reverse proxy
- Restrict wp-admin access to allowlisted source IP addresses until the plugin is removed
- Enforce multi-factor authentication on all administrator accounts to reduce the value of any hijacked session
# Example NGINX rule to block requests carrying the backdoor parameters
if ($args ~* "(^|&)(_wplogin|_wpm)=") {
return 403;
}
# WP-CLI cleanup steps
wp plugin deactivate advanced-responsive-video-embedder
wp plugin delete advanced-responsive-video-embedder
wp user list --role=administrator --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
