Published on 10 August 2026
A single, publicly visible character code is enough to seize complete control of a WordPress website – without any password, without a valid login, without any obstacle whatsoever. That is precisely the reality for around 20,000 websites running the popular WordPress plugin Advanced Responsive Video Embedder (ARVE) in version 10.8.7. Attackers have planted a so-called backdoor – a hidden entry point in the program code – into the plugin. Anyone who knows the right token (and it can be read by anyone in the source code) can pose as an administrator and completely take over the affected site.
The flaw carries the identifier CVE-2026-18072 and, with a CVSS score of 9.8 out of 10, is classified as “critical” – the second-highest danger level that can be assigned at all. A patch, i.e. a security update, does not exist. If you use this plugin, you need to act now.
On 28 July 2026, version 10.8.7 of the Advanced Responsive Video Embedder plugin was released – but this version contained malicious code. According to the current state of knowledge, an attacker gained access to the plugin’s developer account and deliberately planted a backdoor there. This is therefore not an accidental programming error, but a deliberate, targeted attack on the software’s supply chain.
The security firm Wordfence, which discovered the incident, puts it plainly:
“This is not a conventional coding mistake, it’s a supply chain attack that has become increasingly more common in the wild.” – Wordfence
A supply chain attack means: attackers don’t manipulate your website directly, but rather a piece of software you trust and install voluntarily. The malicious code then reaches thousands of websites simultaneously via the perfectly normal plugin update. That is exactly why such attacks are so insidious – trust in official sources is weaponised against the users.
The backdoor hides in the plugin file php/fn-update-check.php. The injected code hooks in very early into WordPress’s startup process – specifically via the so-called “init” hook (a trigger point at which WordPress executes certain functions during loading) with the highest priority. That is the decisive trick: the malicious function runs before WordPress even checks whether a visitor is logged in.
The process is frighteningly simple:
_wplogin or _wpm.35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900).Since this fingerprint sits in the publicly visible source code, every attacker knows it. Wordfence expert Chloe Chamberland explains the significance:
“Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site.” – Chloe Chamberland, Wordfence
In addition, the malicious code sends the address of the affected website as well as the name of the hijacked administrator account to an external control server (a so-called C2 server, short for “Command and Control”) at the address fontswp.com. In this way the attackers build a list of successfully compromised sites in the background. Interestingly, the code deliberately avoids usernames with typical attacker prefixes such as wpsvc_, so as not to accidentally overwrite an account already created by other attackers.
Affected is exclusively version 10.8.7 of the Advanced Responsive Video Embedder plugin (also known for embedding videos from Rumble, Odysee, YouTube, Vimeo and Kick). Around 20,000 websites had this plugin installed. WordPress.org has already removed the plugin from the official directory, so it can no longer be downloaded.
The good news: the attack was detected extremely quickly. Wordfence discovered the backdoor with the help of its AI-powered detection system PRISM in less than two hours after it was injected. The timeline shows a remarkable response speed:
Despite this rapid response, the following holds true: anyone who installed or updated to version 10.8.7 within this window was potentially vulnerable – and the flaw is already being actively exploited.
wpsvc_, developer_, dev_ or wp_update_._wplogin or _wpm. Such entries are a strong indication of an exploitation attempt.If you use, or have used, the affected version, you should assume that your website has been compromised and proceed as follows:
wp-config.php file. This invalidates all active attacker sessions.fontswp.com at the server or firewall level.Since there is no patch and the plugin has been removed from the directory, you will also need to find an alternative solution for embedding videos. Users of the paid Wordfence version already received protective firewall rules on the day of discovery. For the free Wordfence version, these rules will only be provided on 27 August 2026 – until then, please do not rely on the firewall alone, but remove the plugin manually.
This incident is not an isolated case, but rather one in a whole series of supply chain attacks on WordPress plugins in 2026. The attack method is particularly dangerous because it exploits the fundamental trust in official update channels. For operators, this means: even those who diligently install every update can be hit by compromised software.
From a legal standpoint, the situation is serious. Since the vulnerability grants attackers full administrator privileges, there is a very high risk that personal data – such as customer or user data – has been compromised. If version 10.8.7 was installed, a compromise must be assumed.
This triggers your notification obligation under Art. 33 GDPR: data breaches likely to result in a risk to the rights and freedoms of natural persons must be reported to the competent data protection supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of them. A failure to report, or a delayed report, can be penalised with substantial fines under Art. 83(4) GDPR. When in doubt, review together with your data protection officer whether a notification is required – and document your decision in a traceable manner.
The backdoor in Advanced Responsive Video Embedder 10.8.7 is a textbook example of how dangerous supply chain attacks are: exploitation is trivial – a single HTTP request without any login is enough – and the damage is maximal, namely the complete takeover of the website. Around 20,000 websites were potentially affected, and the flaw is already being actively exploited.
Therefore, act without delay: check whether the plugin is installed on your site, remove it completely, review your user and server logs, and, in the event of suspicion, clean up your entire installation. And don’t forget your GDPR obligations. The swift discovery by Wordfence limited the damage – but ultimately it is up to each individual operator to secure their own website again.
Unsure whether your website is affected, or how to cleanly remediate a possible compromise? We at shieldgaps.com support you with the analysis, remediation and correct GDPR notification.