ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites

Executive Summary

A critical supply chain backdoor was inserted into ARVE – Advanced Responsive Video Embedder, a WordPress plugin with approximately 20,000 active installations, on July 28, 2026. The malicious version (10.8.7) contains a hidden authentication bypass backdoor in php/fn-update-check.php that allows any attacker to establish a fully authenticated WordPress administrator session with a single HTTP request — no credentials required.

Wordfence's autonomous AI detection system, PRISM, flagged the compromise within two hours of the malicious commit being introduced. WordPress.org removed the plugin from its repository the same day.

The plugin has no patched version. All sites running ARVE version 10.8.7 must remove it immediately.

How the Backdoor Works

Infection Vector

The compromise is assessed as a supply chain attack via unauthorized access to a developer account. The attacker pushed version 10.8.7 with a hidden backdoor file — php/fn-update-check.php — that is loaded by the plugin's main entry point.

Backdoor Mechanism

The backdoor function _arve_uc_init() is registered on WordPress's init action hook at priority 1, meaning it executes before any standard authentication checks on every single page request.

Attack flow:
1. Attacker sends request with _wplogin=<hash> parameter
   (deliverable via URL query string, POST body, or cookie)
2. _arve_uc_init() compares the value to a hardcoded SHA-256 hash
3. On match: plugin selects an existing administrator account
4. Plugin creates a fully authenticated session for that admin user
5. Attacker has complete admin access — no credentials were checked
6. Plugin phones home to fontswp.com with the site URL and admin username

C2 Exfiltration

Upon successful exploitation, the backdoor transmits the compromised site URL and selected administrator username to the attacker-controlled domain fontswp.com. This allows the attacker to catalog high-value targets for follow-on attacks including webshell installation, malware injection, SEO spam campaigns, database exfiltration, and ransomware deployment.

Detection

How to Check If You Are Affected

Check your installed ARVE version:

# Via WP-CLI
wp plugin list --name=arve --fields=name,version,status

If you see version 10.8.7, your site is compromised.

Check for the backdoor file:

ls -la wp-content/plugins/arve/php/fn-update-check.php

If this file exists, the backdoor is present.

Check for C2 communication: Review server logs for outbound connections to fontswp.com. Any connection to this domain indicates the backdoor executed successfully.

Indicators of Compromise

Immediate Remediation

1. Remove the Plugin

# Via WP-CLI
wp plugin deactivate arve
wp plugin delete arve
 
# Or manually
rm -rf wp-content/plugins/arve/

Do not simply deactivate — the backdoor file must be physically deleted.

2. Audit and Reset All Administrator Accounts

wp user list --role=administrator

Delete any unrecognized admin accounts and reset passwords for all known administrator accounts.

3. Rotate WordPress Security Keys and Salts

Update wp-config.php with new keys from the WordPress salt generator to invalidate all existing sessions.

4. Inspect for Secondary Backdoors

grep -r "eval(base64_decode" wp-content/
grep -r "system(" wp-content/plugins/
grep -r "passthru(" wp-content/plugins/

5. Block C2 Domain

Block outbound connections to fontswp.com at your firewall or DNS resolver.

6. Block Backdoor Parameters at WAF

Add rules to block inbound HTTP requests containing _wplogin or _wpm parameters.

Timeline

Key Takeaways

1. CVSS 9.8 — Complete authentication bypass; full admin takeover with a single HTTP request
2. ~20,000 sites affected — Any site running ARVE v10.8.7 must act immediately
3. No patched version — Remove the plugin entirely; WordPress.org has pulled it
4. Audit all admin accounts — Attacker may have exfiltrated data to C2 before detection
5. Block fontswp.com — Outbound connections confirm successful exploitation
6. Rotate all WordPress security keys — Invalidate all existing sessions

References

• Hackread — Wordfence Finds Critical Backdoor in ARVE WordPress Plugin
• CyberSecurityNews — WordPress Plugin Backdoor Sends Details to C2
• GBHackers — Critical WordPress Plugin Backdoor Exposes 20,000 Sites
• ToolsLib Blog — CVE-2026-18072: ARVE Backdoor Analysis