CVE-2026-18072: WordPress ARVE Plugin Contains Hardcoded Backdoor Enabling Auth Bypass

Overview

CVE-2026-18072 is a critical-severity vulnerability (CVSS 9.8) discovered in version 10.8.7 of the Advanced Responsive Video Embedder (ARVE) plugin for WordPress — a popular plugin supporting video embeds from platforms including YouTube, Vimeo, Rumble, Odysee, Kick, and others.

The vulnerability is a hardcoded backdoor embedded directly in the plugin's PHP source code that allows unauthenticated attackers to completely bypass WordPress authentication.

Technical Details

The backdoor resides in the _arve_uc_init() function, which is registered on WordPress's init hook at a high priority. During the WordPress initialization lifecycle, this function executes early and contains logic that accepts a specially crafted request parameter or trigger condition — granting the requester administrative or elevated access without supplying valid credentials.

Because the function fires on every WordPress page load via the init action hook, any HTTP request to the affected WordPress site can potentially trigger the bypass condition.

Key characteristics:

• No authentication required: The bypass is fully unauthenticated.
• Hardcoded trigger: The backdoor uses a fixed, predictable mechanism (hardcoded key/parameter) baked into the plugin code.
• Broad exposure: The init hook fires globally — not just on specific pages — meaning no knowledge of the target site's structure is needed.

Impact

An unauthenticated attacker exploiting this vulnerability could:

• Gain administrative access to the WordPress dashboard.
• Install or modify plugins and themes (enabling further persistence or RCE).
• Access, modify, or delete all site content and user data.
• Exfiltrate subscriber and customer PII from the WordPress database.

Affected Software

Remediation

1. Remove or update the plugin immediately. Version 10.8.7 should not remain installed on any production WordPress site.
2. Check your WordPress admin user list for any unauthorized accounts created during the exposure window.
3. Audit WordPress access logs for unusual init-phase requests or unexpected admin logins.
4. Rotate all WordPress admin passwords and salts (wp-config.php AUTH_KEY, etc.).
5. Notify your hosting provider if you suspect active compromise.

References

• NVD — CVE-2026-18072
• CVSS Score: 9.8 Critical