Wordfence says its autonomous AI agent, Wordfence PRISM, spotted a backdoored WordPress plugin less than two hours after the malicious code was added, highlighting how quickly supply chain attacks can spread through the plugin ecosystem. The issue affected Advanced Responsive Video Embedder, a plugin with about 20,000 active installations, and was rated critical because it let an unauthenticated attacker gain administrative access with a single request.
What Wordfence found in Advanced Responsive Video Embedder
According to Wordfence, the problem appeared in version 10.8.7 of Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick and other services. The company classified the flaw as CVE-2026-18072 and gave it a CVSS score of 9.8, indicating critical severity.
Wordfence described the issue not as a coding mistake, but as a deliberate supply chain attack. The plugin contained a concealed function that read an attacker-supplied token from the _wplogin or _wpm parameter and compared it to a hardcoded SHA-256 hash embedded in the source code.
Why the backdoor was so dangerous
The malicious code ran on WordPress’s init hook at priority 1, which meant it executed on every request before normal authentication checks. Wordfence said there was no nonce check, no capability check, and no password validation in the flow.
In practical terms, that meant an unauthenticated attacker could send one HTTP request with the right token and be treated as an administrator. Wordfence warned that no credentials, no user interaction, and no brute force were required.
How the attack was structured
Wordfence’s technical write-up says the plugin’s main bootstrap file loaded php/fn-update-check.php, where the hidden logic lived. The naming and structure were designed to look like routine maintenance code, which would make the backdoor harder to spot in casual review.
The code first attempted to create a site-specific token from the WordPress AUTH_KEY and SECURE_AUTH_KEY constants. But if that check failed, it fell back to a hardcoded SHA-256 value: 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900. Wordfence called that static hash a universal master credential because it was publicly visible in the plugin source.
What happened after validation
Once the token was accepted, the code enumerated administrator accounts on the site and filtered out usernames beginning with wpsvc_, developer_, dev_, or wp_update_. Wordfence said that detail strongly suggested the operators had seeded their own accounts on targeted sites and wanted to avoid selecting them.
The code then picked a random administrator from the remaining pool, exfiltrated the site URL and username to an external endpoint at fontswp.com, and set a long-lived authentication cookie using wp_set_auth_cookie($uid, true). After that, the attacker was redirected to the WordPress admin dashboard.
Timeline: detected and contained quickly
Wordfence provided a disclosure timeline showing how quickly the issue moved from introduction to detection. The malicious code was introduced at 08:42 AM EST on July 28, 2026, and Wordfence PRISM identified it at 10:33 AM EST the same day.
By 10:43 AM EST, Wordfence said it had validated the proof of concept and confirmed that a single HTTP GET request could produce a full administrator session. Because the issue involved malicious code injected into a publicly distributed plugin, Wordfence notified the WordPress.org plugin team rather than contacting the developer directly.
The WordPress.org team acknowledged the report at 11:09 AM EST and closed the plugin for downloads.
Who is protected and what site owners should do
Wordfence said Premium, Care, and Response customers received a firewall rule on July 28, 2026 to block known exploit attempts. Users on the free version will receive the same protection on August 27, 2026.
Even so, Wordfence urged site owners to remove Advanced Responsive Video Embedder immediately and treat any site that ran the affected version as potentially compromised. The company said users should verify whether their site ever used the vulnerable release, since a backdoor of this type should be assumed to leave lasting damage even if exploitation has not been observed.
- Uninstall Advanced Responsive Video Embedder as soon as possible.
- Audit administrator accounts and revoke anything unexpected.
- Invalidate all existing sessions.
- Rotate WordPress secret keys.
- Review files and the database for secondary backdoors or unauthorized changes.
Why this case matters beyond one plugin
This incident is a reminder that plugin ecosystems can be exposed to more than ordinary bugs. A compromised release can turn trusted software into an attack vector, and those attacks can be difficult to detect if the malicious code is built to resemble normal update or compatibility logic.
Wordfence’s report also shows the value of fast automated detection. In this case, PRISM found the backdoor within two hours of introduction, limiting the window in which the malicious plugin could circulate before the WordPress.org team closed downloads.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 10, 2026 at 4:24 pm
1 views
