Backdoor in WordPress Plugin: Admin Takeover via CVE-2026-18072

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/6 · Supply Chain Compromise

Attackers gained access to the developer account and injected malicious code into the official plugin release.

T1195.002 – Compromise Software Supply Chain T1078 – Valid Accounts
  • Affected: ARVE plugin version 10.8.7 (approx. 20,000 installations)
  • Injection on 2026-07-28 at 08:42 EST
  • Not an accidental bug but a targeted supply chain attack (per Wordfence)
  • Distributed via the regular WordPress plugin update
PHASE 2/6 · Persistence via Backdoor

A hidden backdoor in the plugin code hooks early into the WordPress startup process.

T1505.003 – Server Software Component: Web Shell T1554 – Compromise Host Software Binary
  • Backdoor in the file php/fn-update-check.php
  • Hooked via the 'init' hook with highest priority
  • Runs before WordPress checks whether a visitor is authenticated
  • CVE-2026-18072, CVSS 9.8 (critical)
PHASE 3/6 · Authentication Bypass

A static token embedded in the source code serves as universal credentials with no login required.

T1190 – Exploit Public-Facing Application T1078.001 – Default Accounts
  • Attacker sends token via parameter _wplogin or _wpm
  • Compared against a hardcoded SHA-256 hash (35fe7057…3b3900)
  • Hash is publicly visible in the source code to everyone
  • Exploited via a single unauthenticated HTTP request
PHASE 4/6 · Privilege Escalation to Admin

On a matching token, the script logs the attacker in as an existing administrator.

T1068 – Exploitation for Privilege Escalation T1078 – Valid Accounts
  • Automatic login as a randomly selected existing admin account
  • Full administrative control over the website
  • Avoids accounts with prefixes like wpsvc_ to not overwrite other backdoors
PHASE 5/6 · Command & Control / Exfiltration

The malicious code reports compromised sites to an external command-and-control server.

T1071.001 – Application Layer Protocol: Web Protocols T1041 – Exfiltration Over C2 Channel
  • Sends the site address and the hijacked admin username
  • C2 server: fontswp.com
  • Attackers maintain a list of compromised sites in the background
PHASE 6/6 · Impact & Site Takeover

Attackers gain full control and can steal data or inject further malicious code.

T1496 – Resource Hijacking T1565 – Data Manipulation
  • Full site takeover, theft of customer data possible
  • No patch available – only immediate removal helps
  • Active exploitation observed in the wild
  • GDPR breach notification duty under Art. 33 (72 hours) if compromised
Short & clear answers
Frequently asked questions about this incident
Am I affected by the ARVE backdoor (CVE-2026-18072)?
Only version 10.8.7 of the 'Advanced Responsive Video Embedder' plugin is affected. Check your WordPress dashboard under 'Plugins' to see whether this plugin is or was installed in exactly that version. If so, you should assume your site has been compromised, as the vulnerability is already being actively exploited.
What should I do right now if I use the affected plugin?
Delete the plugin completely and immediately (don't just deactivate it) and check all administrator accounts for unknown users, especially those with prefixes like 'wpsvc_', 'developer_' or 'wp_update_'. Terminate all sessions, regenerate the Secret Keys (salts) in wp-config.php, and reset all admin passwords. Then run a full malware scan and block outbound connections to 'fontswp.com'.
Is there a security update (patch) for this vulnerability?
No, no patch exists. WordPress.org fully removed the plugin from its directory on July 28, 2026, so it can no longer be downloaded. You must therefore delete the plugin and find an alternative solution for embedding videos.
How can I tell whether my website has already been attacked?
Review your WordPress user list for unknown administrator accounts, particularly those with prefixes like 'wpsvc_', 'developer_', 'dev_' or 'wp_update_'. Also check your server logs for HTTP requests containing the parameters '_wplogin' or '_wpm' — such entries are a strong indicator of an exploitation attempt.
Do I need to report this incident to the data protection authority?
If version 10.8.7 was installed, you should assume a compromise in which attackers gained full administrator rights and thus access to personal data. Under Article 33 GDPR, you must report such a data breach to the responsible supervisory authority, ideally within 72 hours of becoming aware of it. Failing to report or reporting late can result in fines.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.