Website owners using WordPress should immediately check their installed plugins after security researchers uncovered a dangerous backdoor hidden inside a popular plugin. The malicious code could allow hackers to gain complete administrator access to vulnerable websites without needing a username or password.
The compromised plugin is the Advanced Responsive Video Embedder (ARVE), specifically version 10.8.7. The vulnerability has been assigned CVE-2026-18072 and carries a critical CVSS severity score of 9.8. The plugin has approximately 20,000 active installations, making the discovery particularly concerning.
According to security researchers at Wordfence, the issue was identified by its AI-powered vulnerability detection system, Wordfence PRISM, on July 28, 2026, less than two hours after the malicious code appeared in the plugin.
Unlike traditional software vulnerabilities caused by coding mistakes, this incident is believed to be a supply chain attack, where attackers compromised the plugin’s distribution process and inserted malicious code before it reached users.
The hidden backdoor was placed inside a file named php/fn-update-check.php, which loads automatically when the plugin is executed. The malicious code accepts specially crafted request parameters that act as a master authentication key. Since the required security token is embedded in the publicly available plugin source code, attackers can easily obtain it without needing to crack passwords or exploit user accounts.
Once activated, the malware searches the website for administrator accounts and automatically logs the attacker into one of them. Interestingly, the malicious code intentionally skips administrator usernames beginning with wpsvc_, developer_, dev_, and wp_update_, suggesting the attackers wanted to avoid interfering with accounts they may have controlled.
After successfully taking over an administrator account, the malware silently reports the website’s URL and the compromised administrator username to fontswp.com, a command-and-control server believed to be operated by the attackers. This allows the attackers to monitor successful compromises and identify valuable targets.
As stated by Wordfence, exploiting the backdoor requires only a single specially crafted HTTP request. Attackers do not need valid login credentials, administrator interaction, phishing emails, or brute-force attacks. A vulnerable website can be fully compromised within seconds.
Following the discovery, Wordfence immediately alerted the WordPress.org Plugin Team. The plugin repository was taken offline on July 28, 2026, preventing further downloads of the compromised version.
The WordPress.org team also confirmed that the malicious release had not yet been widely distributed through automatic plugin updates. However, website owners should still verify whether version 10.8.7 is installed and perform a full security audit if necessary.
Security experts recommend taking the following actions immediately if your website uses this plugin:
- Check whether Advanced Responsive Video Embedder version 10.8.7 is installed.
- Remove the compromised version immediately.
- Review all administrator accounts for suspicious activity.
- Log out all active users and invalidate existing login sessions.
- Rotate your WordPress secret keys and salts.
- Reset administrator passwords.
- Scan your website files and database for additional malware or hidden backdoors.
- Review and block outbound connections to
fontswp.com.
This incident highlights the growing threat of software supply chain attacks, where trusted applications become attack vectors after being compromised during distribution. Even reputable plugins should be monitored regularly, and website administrators should implement layered security measures, including web application firewalls, malware scanning, and routine security audits.
Source: As reported by Wordfence.
For more interesting cybersecurity news, WordPress security updates, and technology articles, check out our blog page at https://www.absmiley.com/blog/