CVE-2026-18072 in Advanced Responsive Video Embedder Plugin
Summary
by MITRE • 07/29/2026
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in question represents a critical authentication bypass flaw within the Advanced Responsive Video Embedder plugin for WordPress, specifically affecting version 10.8.7 and potentially earlier releases. This backdoor mechanism operates through a hardcoded credential system that fundamentally undermines the security model of WordPress installations. The flaw manifests through the `_arve_uc_init()` function which is strategically registered with WordPress's `init` hook at priority level 1, ensuring it executes before any standard authentication mechanisms. This timing placement allows the backdoor to intercept all incoming requests and establish unauthorized access without proper verification.
The technical implementation of this vulnerability follows a straightforward yet devastating approach where the plugin source code contains a hardcoded SHA-256 hash that serves as universal credentials for administrative access. Attackers can simply supply a token through either the `_wplogin` or `_wpm` URL parameters and compare it against this embedded hash without any additional verification steps. The absence of nonce verification, capability checks, or password validation creates a complete breakdown in authentication controls. This hardcoded credential mechanism directly violates fundamental security principles and represents a clear violation of CWE-254, which addresses weaknesses in authentication mechanisms where insufficient protection exists against credential compromise.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it grants attackers complete administrative control over affected WordPress sites without requiring any legitimate credentials or account compromise. This level of access enables full site manipulation including but not limited to content modification, plugin and theme management, user account creation or deletion, and potentially even data exfiltration or deployment of additional malicious payloads. The backdoor's presence in the source code suggests a sophisticated attack vector where an attacker gained commit access to the legitimate developer account, which aligns with ATT&CK technique T1578.002 for modifying existing software to introduce persistence mechanisms and T1078.004 for valid accounts that are used to gain initial access.
The implications of this vulnerability span across multiple security domains including supply chain attacks, where compromised plugins can affect thousands of WordPress installations simultaneously. This particular backdoor demonstrates how seemingly legitimate software can contain malicious functionality that operates silently in the background, making detection particularly challenging for system administrators. The public accessibility of the hardcoded token within the source code creates an environment where any attacker with knowledge of the plugin's functionality can exploit this weakness regardless of their location or network position. Organizations relying on WordPress for content management and business operations face significant risk exposure through this vulnerability, as it essentially removes the authentication layer that protects against unauthorized administrative access. The lack of proper input validation or sanitization in the authentication flow further compounds the issue by allowing arbitrary account selection, meaning attackers can impersonate any existing administrator account rather than being limited to a specific user identity. This vulnerability represents a classic example of how insecure coding practices and inadequate security review processes can introduce persistent backdoors that remain undetected until exploited, making it particularly dangerous for widespread deployment scenarios where the plugin might be used across multiple organizations or installations.