CVE-2026-18072Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-506

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
10 mentions across 6 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 8 signals
Disclosure: 7 classified signals
Peaked 5d ago at 5 mentions (2026-07-29); latest day: 1
10 total mentions across 6 days

Deep dive

Activity timeline10 mentions / 6d

Signal classification2 categories

Disclosure

770.0%

Active Exploitation

330.0%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	5	Active Exploitation1Disclosure4
2026-07-30	1	Active Exploitation1
2026-08-05	1	Disclosure1
2026-09-05	1	Disclosure1
2026-09-17	1	Active Exploitation1
2026-10-20	1	Disclosure1

Full discourse10 posts

elhacker.NET@elhackernet92d
Disclosure
Puerta trasera en plugin Advanced Responsive Video Embedder de WordPress Se ha detectado una puerta trasera crítica en la cadena de suministro del plugin de WordPress Advanced Responsive Video Embedder (versión 10.8.7). Esta vulnerabilidad, identificada como CVE-2026-18072 con una puntuación CVSS de 9.8 https://blog.elhacker.net/2026/07/puerta-trasera-en-plugin-advanced.html
Post summary
The article announces a critical CVE-2026-18072 backdoor in the Advanced Responsive Video Embedder WordPress plugin, scoring 9.8 CVSS, with no evidence of active exploitation, patch, or PoC.
116052114.7K
141.9K followersView on X
pdnuclei-bot@pdnuclei_bot42d
Active Exploitation
🚨 CVE-2026-18072 - critical 🚨 Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass > The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 a... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-18072 @...
Post summary
The post reports an active supply chain compromise (CVE-2026-18072) involving hardcoded backdoors in versions 10.8.7 and 10.8.8 of the Advanced Responsive Video Embedder WordPress plugin, and shares a ProjectDiscovery library link for detection/PoC purposes.
00024336
1.4K followersView on X
iototsecnews@iototsecnews85d
Disclosure
WordPress プラグインの脆弱性 CVE-2026-18072 が FIX：20,000 サイトで管理者乗っ取りの可能性 https://iototsecnews.jp/2026/07/29/critical-wordpress-plugin-backdoor-exposes-20000-sites-to-full-administrator-takeover/ Advanced Responsive Video Embedder において、開発元のアカウントが侵害され、バックドアが混入されたことで、脆弱性 CVE-2026-18072 が発生しています。この脆弱性が攻撃者に悪用されると、特別なログイン情報を必要とせずに管理者権限を奪われ、Web サイトの情報の流出や内部への不正操作などが生じる恐れがあります。システムを安全に利用するためにも、該当のプラグインを速やかに削除する必要があります。あわせて、アカウント一覧の確認／パスワード変更／不要なセッションの破棄などの対応も推奨されています。 #AdvancedResponsiveVideoEmbedder #CVE202618072 #Vulnerability #WordPress
Post summary
CVE-2026-18072 is a backdoor vulnerability in the Advanced Responsive Video Embedder WordPress plugin that can let attackers gain full administrator rights without special login credentials. Users are urged to delete the plugin and secure accounts, as up to 20,000 sites could be affected.
01000219
506 followersView on X
moton@moton91d
Disclosure
CVE-2026-18072: Video Embedder Backdoor Admin Bypass - https://securityonline.info/cve-2026-18072-video-embedder-backdoor/
Post summary
CVE-2026-18072 is a newly announced vulnerability involving a Backdoor Admin Bypass in Video Embedder, with only the CVE ID and a link provided; no PoC, exploit, active exploitation, patch, or false positive claims are mentioned.
0001074
718 followersView on X
Minery Report@MineryReport92d
Disclosure
@elhackernet CVE-2026-18072 (CVSS 9.8) en el plugin ARVE ilustra el riesgo real de la cadena de suministro: la amenaza no viene del código que escribes tú sino del que instalas. Para empresas con WordPress corporativo, la auditoría continua de plugins de terceros ya no es opcional.
Post summary
The tweet announces CVE-2026-18072, noting its high CVSS score of 9.8 and emphasizing the supply‑chain risk of the ARVE plugin, urging continued audits of third‑party plugins in corporate WordPress deployments.
00010108
301 followersView on X
IntegSec@integ_sec8d
Disclosure
CVE-2026-18072: Advanced Responsive Video Embedder Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04BMnZG0
Post summary
The text is a headline/link announcing CVE-2026-18072, an authentication bypass in Advanced Responsive Video Embedder, with no PoC, exploit, patch, or active exploitation details provided in the text itself.
0000026
35 followersView on X
System Force I.T.@systemforce54d
Disclosure
On 28 July 2026, security researchers at Wordfence discovered that version 10.8.7 of the Advanced Responsive Video Embedder (ARVE) WordPress plugin had been deliberately backdoored. https://systemforce.co.uk/blog/2026/09/05/arve-plugin-backdoor-cve-2026-18072-wordpress/ https://t.co/HsFCMqK8nu
Post summary
Security researchers announced that version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin has been backdoored, identifying CVE‑2026‑18072.
0000038
3.0K followersView on X
キタきつね@foxbook91d
Active Exploitation
実環境での悪用事例：CVE-2026-18072（CVSS 9.8）により、20,000のWordPressサイトに完全な管理者権限が付与される Exploited in the Wild: CVE-2026-18072 (CVSS 9.8) Grants Full Administrative Control to 20,000 WordPress Sites #DailyCyberSecurity (Jul 29) https://securityonline.info/cve-2026-18072-video-embedder-backdoor/
Post summary
CVE‑2026‑18072 has been actively exploited in the wild, granting full administrative access to roughly 20,000 WordPress sites; no mitigation information or false‑positive claim is present.
00000255
4.9K followersView on X
ThreatAft@ThreatAft91d
Disclosure
🚨 WordPress ARVE Backdoor — CVSS 9.8 — NO PATCH CVE-2026-18072: Hardcoded backdoor in ARVE plugin 10.8.7 allows unauthenticated admin takeover. Remove version 10.8.7 NOW. → http://threataft.com/articles/wordpress-arve-cve-2026-18072-backdoor #cybersecurity #infosec #WordPress #ARVE #Backdoor #ThreatIntel
Post summary
The tweet announces a critical backdoor vulnerability in the ARVE WordPress plugin, noting no patch exists and advising removal of the affected version, but does not provide evidence of active exploitation or an exploit tool.
0000049
35 followersView on X
Daily CyberSecurity@Daily_CyberSec92d
Active Exploitation
Active exploitation of CVE-2026-18072, a CVSS 9.8 video embedder backdoor, grants attackers full administrative control over 20,000 WordPress sites. #CVE202618072 #WordPress #CyberSecurity #Backdoor http://securityonline.info/cve-2026-18072-video-embedder-backdoor/
Post summary
The post reports active exploitation of CVE-2026-18072, describing a high‑severity backdoor that allows attackers full admin access to roughly 20,000 WordPress sites.
00000395
12.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-18072

Minery Report[verified]@MineryReportDisclosure

The tweet announces CVE-2026-18072, noting its high CVSS score of 9.8 and emphasizing the supply‑chain risk of the ARVE plugin, urging continued audits of third‑party plugins in corporate WordPress deployments.

IntegSec[verified]@integ_secDisclosure

The text is a headline/link announcing CVE-2026-18072, an authentication bypass in Advanced Responsive Video Embedder, with no PoC, exploit, patch, or active exploitation details provided in the text itself.

キタきつね[verified]@foxbookActive Exploitation

CVE‑2026‑18072 has been actively exploited in the wild, granting full administrative access to roughly 20,000 WordPress sites; no mitigation information or false‑positive claim is present.

elhacker.NET@elhackernetDisclosure

The article announces a critical CVE-2026-18072 backdoor in the Advanced Responsive Video Embedder WordPress plugin, scoring 9.8 CVSS, with no evidence of active exploitation, patch, or PoC.

pdnuclei-bot@pdnuclei_botActive Exploitation

The post reports an active supply chain compromise (CVE-2026-18072) involving hardcoded backdoors in versions 10.8.7 and 10.8.8 of the Advanced Responsive Video Embedder WordPress plugin, and shares a ProjectDiscovery library link for detection/PoC purposes.

iototsecnews@iototsecnewsDisclosure

CVE-2026-18072 is a backdoor vulnerability in the Advanced Responsive Video Embedder WordPress plugin that can let attackers gain full administrator rights without special login credentials. Users are urged to delete the plugin and secure accounts, as up to 20,000 sites could be affected.

moton@motonDisclosure

CVE-2026-18072 is a newly announced vulnerability involving a Backdoor Admin Bypass in Video Embedder, with only the CVE ID and a link provided; no PoC, exploit, active exploitation, patch, or false positive claims are mentioned.

System Force I.T.@systemforceDisclosure

Security researchers announced that version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin has been backdoored, identifying CVE‑2026‑18072.