Backdoor in WordPress Plugin ARVE: CVE-2026-18072 critical

Published on 31 July 2026

A single request in the browser – that's all an attacker needs to gain full administrator access to your WordPress website. No password, no user account, no lengthy guessing attempts. That's how the backdoor works that was discovered on 28 July 2026 in the widely used WordPress plugin Advanced Responsive Video Embedder (ARVE for short). Only version 10.8.7 is affected – but for every website that has this version installed, one thing is clear: it must be treated as fully compromised.

What makes this case special: it is not an accidental programming error, but a deliberate supply chain attack – that is, an attack carried out through the software's own supply chain. An attacker gained access to the plugin's developer account and intentionally injected malicious code, which was then meant to be distributed via the official WordPress directory. In this article you'll learn exactly what happened, whether you are affected, and which concrete steps you need to take now.

What happened?

On 28 July 2026 at 08:42 (US Eastern Time), a malicious version of the ARVE plugin was uploaded to WordPress.org. ARVE is used to embed videos from platforms such as YouTube, Vimeo, Rumble and Odysee into websites, and with around 20,000 active installations it is a fairly widespread tool.

By 10:33 – less than two hours later – Wordfence PRISM raised the alarm. This is an autonomous, AI-powered threat analysis service run by security provider Wordfence. After a brief review by human security researchers, the incident was reported directly to the WordPress.org plugin team at 10:43. At 11:09, WordPress.org blocked the plugin from being downloaded.

The vulnerability is tracked under the identifier CVE-2026-18072 and rated at the highest possible severity: CVSS 9.8 out of 10 (critical). Its CWE classification is CWE-506 – "Embedded Malicious Code", i.e. intentionally embedded malicious code.

Technical background – explained clearly

The injected code hides in a file with the harmless-sounding name fn-update-check.php – deliberately chosen to look like a routine update check. The main plugin file loads this file unconditionally.

The actual trick: a function called _arve_uc_init() registers itself on the so-called "init hook" with the highest priority. A hook is an attachment point at which WordPress executes custom code on every request. Because of the high priority, the malicious code runs before WordPress even performs its own authentication checks.

Now comes the core of the attack: the code reads a value from every incoming request – passed via the parameters _wplogin or _wpm. If this value contains a specific SHA-256 hash hardcoded in the code (a kind of cryptographic fingerprint), the attacker is immediately logged in as a randomly selected administrator. This hash – 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 – was included directly in the publicly viewable source code. It thus functioned as a universal master key for all affected websites.

In addition, on every successful exploitation the backdoor retrieves your website's address and the username of the selected administrator, sending this data to a server controlled by the attacker – the so-called C2 server (command-and-control server, the attacker's control centre) at the address fontswp.com. The code then sets a persistent "keep me logged in" cookie and redirects the attacker straight to the admin dashboard.

Notably, the malicious code deliberately excludes administrator accounts with the prefixes wpsvc_, developer_, dev_ or wp_update_. This suggests that the attackers had created such accounts themselves and did not want to accidentally take them over. Wordfence sums up its assessment as follows:

"This is not a conventional programming bug, but a supply chain attack that is increasingly common in the wild. [...] Since exploitation requires no credentials, no user interaction and only a single HTTP request, we recommend treating every website running the affected version as potentially compromised." – Chloe Chamberland, Wordfence

Who is affected?

Only version 10.8.7 of the ARVE plugin is affected. All other versions do not contain the backdoor.

There is one important piece of reassuring news here: thanks to the "Protect The Shire" initiative launched by WordPress.org in June 2026, new plugin releases are held back for up to 24 hours before they are distributed via automatic updates. During this time, an AI agent named "Gandalf" reviews the changes. Because the backdoor was discovered and blocked within this window, version 10.8.7 did not reach end users via automatic updates.

But this does not mean nobody is affected. Wordfence makes it clear:

"The plugin remains compromised and is not available for download. [...] Site operators who updated manually or bypassed WordPress's 24-hour delay via third parties would have been affected." – Chloe Chamberland, Wordfence

Plugin author Nicolas Jonas argued in a comment that there was no reason to delete the plugin, since the malicious version never reached end users. Wordfence disagrees with this assessment: anyone who installed version 10.8.7 manually, via a staging system, a development environment or a third-party update is at risk. Caution is clearly warranted here – especially since Wordfence had already blocked 16 active attack attempts against this vulnerability within the first 24 hours.

How to check whether you are affected

1. Check the plugin version: Log into the WordPress dashboard and navigate to Plugins > Installed Plugins. Look for "Advanced Responsive Video Embedder". If version 10.8.7 is shown, your website is potentially affected.
2. File check via FTP/SSH: Connect to your server via FTP, SFTP or SSH and open the folder wp-content/plugins/advanced-responsive-video-embedder/php/. Does the file fn-update-check.php exist there? Open it and search for the hash 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 or the string fontswp.com. A match confirms the backdoor.
3. Check server logs for exploitation: Search your access logs for the parameters _wplogin or _wpm, for example with the command grep '_wplogin\|_wpm' /var/log/apache2/access.log. Any match indicates an exploitation attempt.
4. Check outgoing connections: Search your PHP error logs or use a network monitor to look for connections to fontswp.com. Such connections indicate a successful exploitation.
5. Review administrator accounts: Go to Users > All Users, filter by the "Administrator" role and watch for unknown accounts – especially those with the prefixes wpsvc_, developer_, dev_ or wp_update_.
6. Run a malware scan: If Wordfence is installed, run a full scan. The plugin detects the backdoor file.

What you need to do now

If you had version 10.8.7 in use, work through the following steps – and when in doubt, treat the website as compromised:

1. Uninstall the plugin immediately: Deactivating is not enough. Go to Plugins > Installed Plugins, deactivate ARVE and then click "Delete". No patch exists so far (as of 31 July 2026), and the plugin remains blocked on WordPress.org.
2. Invalidate all sessions: Rotate the WordPress security keys in the wp-config.php file. Generate new keys at https://api.wordpress.org/secret-key/1.1/salt/ and replace the corresponding lines. This invalidates all existing login cookies – including those set by the attacker.
3. Clean up administrator accounts: Delete all unknown admin accounts and change the passwords of all legitimate administrators.
4. Run a full malware scan: Scan files and the database with a security plugin (Wordfence, Sucuri) to find secondary backdoors.
5. Check the database: In particular, review the tables wp_options (such as siteurl, admin_email, active_plugins), wp_users and wp_usermeta for unauthorised changes.
6. Change all credentials: WordPress passwords, database password, FTP/SSH access and hosting panel passwords.
7. Block connections to fontswp.com: Set up a firewall rule that prevents outgoing connections to this domain – at the hosting level or via .htaccess/Nginx configuration.
8. Restore a backup: If there are signs of successful exploitation, restore a clean backup from before 28 July 2026.
9. Install a security plugin: An active plugin with a Web Application Firewall (WAF – a protective layer that filters malicious requests) helps detect future attacks early. Wordfence Premium, Care and Response users have been protected by a firewall rule since 28 July 2026; users of the free Wordfence version receive the same protection from 27 August 2026.

GDPR: Your obligations as a website operator

As soon as an attacker has gained administrator access via the backdoor, they have access to all personal data stored in WordPress – customer data, email addresses from contact forms, order data from WooCommerce shops, comments and possibly payment information. In addition, the site URL and admin username are actively exfiltrated to the attacker's server. This constitutes a personal data breach within the meaning of Art. 4 No. 12 GDPR.

Notification obligation (Art. 33 GDPR): As the controller, you must report such a data breach without undue delay – ideally within 72 hours of becoming aware of it – to the competent supervisory authority. In the case of full administrator access to a website containing customer data, it is generally not possible to argue that no risk exists.

Notification of data subjects (Art. 34 GDPR): If there is a high risk to the affected individuals – for example where payment, health or sensitive communications data has been accessed – you must inform the data subjects without undue delay.

Documentation obligation (Art. 33(5) GDPR): Even if no notification is required, you must document the incident internally – the facts, its effects and the measures taken.

The potential fines are substantial: breaches of the notification obligation can be penalised with up to 10 million euros or 2% of global annual turnover, while breaches of fundamental data protection obligations can be penalised with up to 20 million euros or 4%. That supervisory authorities do crack down on inadequate data security is illustrated, for example, by the 14.5 million euro fine against Deutsche Wohnen SE (2019).

Context: A pattern with method

The ARVE incident is not an isolated case but part of a growing trend. According to Patchstack's State of WordPress Security 2025, 7,966 new vulnerabilities were discovered in the WordPress ecosystem in 2024 – an increase of 34% over the previous year, the vast majority of them in third-party plugins. 43% of these vulnerabilities could be exploited without authentication. Over 500,000 WordPress websites were infected with malware in 2024.

Supply chain attacks on WordPress plugins are becoming more frequent: in June 2024, five plugins were compromised in a coordinated attack; in April 2026, over 30 plugins were fitted with backdoors after being sold to a new owner. It was precisely in response to this that WordPress.org launched the "Protect The Shire" initiative. Matt Mullenweg announced in June 2026:

"Effective immediately, every new plugin release will wait up to 24 hours before being distributed via automatic updates. This gives everyone – including a new Wapuu named Gandalf – the chance to review changes." – Matt Mullenweg, WordPress.org

The ARVE case is considered the first major success of this strategy: the combination of a delay window and AI-powered detection by Wordfence PRISM prevented the backdoor from being rolled out across the board via automatic updates.

Conclusion

CVE-2026-18072 vividly demonstrates just how dangerous supply chain attacks are: a single compromised developer account can put thousands of websites at risk – entirely without any action on the part of the operators. The good news: thanks to Wordfence's rapid response and WordPress.org's new 24-hour window, the backdoor was largely contained. The bad news: anyone who installed version 10.8.7 manually or via workarounds must assume full compromise.

So check immediately whether your website had version 10.8.7 in use. If so, uninstall the plugin, rotate your security keys, change all credentials and review your GDPR notification obligations. And, more fundamentally: an active security plugin with a firewall is no longer a luxury but, given the rising number of plugin attacks, a basic requirement for anyone running a WordPress website.