A critical supply chain attack targeting the WordPress ecosystem has exposed approximately 20,000 websites to full administrative compromise after a widely used plugin was found to contain a deliberately injected backdoor.
Chloe Chamberland at Wordfence disclosed that the vulnerability, tracked as CVE-2026-18072 with a CVSS score of 9.8, affects version 10.8.7 of the Advanced Responsive Video Embedder plugin.
Wordfence’s AI-driven threat intelligence platform, PRISM, identified the malicious code within two hours of its introduction on July 28, 2026, highlighting the increasing role of automated detection in identifying emerging threats.
Critical WordPress Plugin Flaw
Unlike conventional vulnerabilities caused by developer mistakes, this incident represents a confirmed supply chain compromise.
The plugin was modified to include a stealth authentication bypass mechanism that enables unauthenticated attackers to gain administrator access using a single HTTP request.
This significantly lowers the barrier to exploitation and increases the potential for widespread abuse. The backdoor is implemented through a function named _arve_uc_init(), which is executed early in the WordPress initialization process via the init hook.
It processes attacker-controlled input from request parameters such as _wplogin or _wpm and validates it against a hardcoded SHA-256 hash embedded directly in the plugin source code.
Because this hash effectively acts as a universal authentication token, any attacker with access to the plugin’s publicly available code can exploit it without credentials or user interaction.
Once the token is validated, the malicious logic enumerates administrator accounts on the target site, selects one, and silently establishes a persistent authenticated session using built-in WordPress functions.
At the same time, the compromised site’s URL and the selected administrator username are exfiltrated to an external command-and-control server associated with the attackers. The victim is then seamlessly redirected to the WordPress admin dashboard, completing the takeover.
Wordfence confirmed that exploitation requires only a single crafted HTTP request, with no need for prior access, brute force attempts, or user engagement. This simplicity makes the vulnerability particularly dangerous in real-world attack scenarios.
Following responsible disclosure, the WordPress.org plugin team responded quickly by removing the plugin from the official repository to prevent further distribution.
Wordfence also deployed firewall rules for its premium customers on the same day, with protection for free users scheduled for release on August 27, 2026.
Although the malicious version was reportedly not widely auto-deployed, security experts caution that any site running the affected version should be considered at risk.
Administrators are strongly advised to immediately remove the plugin, verify installed versions, rotate WordPress security keys, audit all administrator accounts, invalidate active sessions, and conduct a comprehensive review of files and databases for potential persistence mechanisms or secondary payloads.
This incident underscores the growing threat of supply chain attacks within open-source ecosystems, where trusted software components can be weaponized to deliver highly effective and difficult-to-detect compromises at scale.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
