Junglewise Threat Intelligence

CVE-2026-18072: Advanced Responsive Video Embedder authentication bypass via hardcoded backdoor

CVE-2026-18072 · Severity: critical · CVSS 9.8 · Published 2026-07-29

Executive brief

A popular WordPress plugin used for embedding videos from platforms like YouTube and Vimeo contains a hardcoded backdoor. This flaw allows an unauthorized person to bypass all security checks and log in as a site administrator. Once logged in, the attacker has full control over the website, including the ability to steal data, modify content, or shut down the service.

Technical details

The vulnerability is classified as Embedded Malicious Code (CWE-506) and functions as an authentication bypass. The `_arve_uc_init()` function is hooked to the WordPress `init` action at priority 1, ensuring it executes before standard authentication checks. It monitors for a specific token provided via the `_wplogin` or `_wpm` HTTP parameters. This token is validated against a hardcoded SHA-256 hash within the plugin's source code. If the token matches, the attacker is automatically authenticated as an administrator without requiring a password or nonce verification. This backdoor was likely introduced via a compromised developer account.

Affected products

  • nico23 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References