Security incident · 29 Jul 2026
Advanced Responsive Video Embedder release carried a login backdoor
A malicious release of the ARVE video plugin (10.8.7) let anyone with a secret token log in as an admin. It's believed the attacker got in through the developer's account. WordPress.org pulled the plugin.
- Component
- Advanced Responsive Video Embedder (ARVE)
- CVE
- CVE-2026-18072
- CVSS
- 9.8
- Affected versions
- 10.8.7
- Fixed in
- Removed from WordPress.org
- Type
- Backdoor
- Status
- Malicious release shipped
- Disclosed
- 29 Jul 2026
What happened
Someone pushed a malicious version, 10.8.7, of Advanced Responsive Video Embedder (ARVE), a plugin for embedding video. Reports say the code was most likely added after an attacker got into a developer account. The backdoor was rated 9.8.
It hid in a file called fn-update-check.php and ran very early on every page load, before any login check. One web request with a secret token logged the attacker in as one of the site's administrators, picked at random. It also sent the site address and that admin's username to an outside server, fontswp.com.
Wordfence's automated scanning flagged the code about two hours after it appeared. WordPress.org then removed the plugin from distribution. Reports say the bad version was not widely installed. Around 20,000 sites were exposed.
Who is affected
- Any site that installed or auto-updated to ARVE 10.8.7.
What to do
- Remove the plugin.
- Check every user account for administrators you don't recognize.
- Change the WordPress authentication keys and salts in
wp-config.php. That logs out every active session. - Treat a site that ran 10.8.7 as compromised. Review it for anything else the attacker may have left behind.
Timeline
- July 28, 2026: Malicious 10.8.7 published. Wordfence detects it about two hours later and ships a firewall rule for premium users.
- July 29, 2026: Public reports. The plugin is pulled from WordPress.org.
- Aug 27, 2026: Firewall protection scheduled for Wordfence free users.