Exploited in the Wild: CVE-2026-18072 (CVSS 9.8) Grants Full Administrative Control to 20,000 WordPress Sites
Do Son 
TL;DR
Threat actors injected a critical backdoor into the Advanced Responsive Video Embedder plugin. This flaw tracks as CVE-2026-18072 (CVSS 9.8). Attackers can bypass authentication entirely. They use this to take over affected websites.
Why It Matters
Supply chain attacks present severe risks to web infrastructure. Threat actors deliberately planted this malicious code. They did not exploit an accidental developer error. Furthermore, hackers are actively exploiting this vulnerability in the wild. A successful attack grants full administrative control to the intruder. Consequently, attackers can steal data, install malware, or deface websites. According to Wordfence, this plugin has approximately 20,000 active installations. Therefore, thousands of web administrators face immediate danger. Wordfence PRISM identified this threat rapidly.
How the Attack Works
The backdoor relies on a maliciously injected function. The script registers this function to run before normal authentication checks. First, the attacker sends a specific HTTP request. They include a known 64-character token in the request parameters. Next, the plugin compares this token against a hardcoded SHA-256 hash. The script skips standard security checks like nonces and passwords.
Silent Exfiltration
After validating the token, the script lists site administrators. It carefully avoids usernames created by the attackers themselves. Then, it selects a random legitimate administrator account. Finally, it forces a login as that administrator. The script also sends the site URL and admin username to an external server. This server sits at fontswp.com.
Affected Versions
This security incident affects the Advanced Responsive Video Embedder plugin for WordPress. Specifically, the CVE-2026-18072 backdoor exists only in version 10.8.7. Other versions remain unaffected by this specific code injection.
Patch and Mitigation Steps
Administrators must remove the Advanced Responsive Video Embedder plugin immediately. The WordPress.org team already closed the software for new downloads. Luckily, the malicious release did not distribute widely via automatic updates.
Incident Response Actions
However, users running version 10.8.7 must assume full compromise. First, you should audit all administrator accounts immediately. Next, invalidate all active user sessions. Then, rotate your WordPress secret keys. Finally, conduct a deep scan of your site files and database. You must check for secondary backdoors.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
