Wordfence Finds Critical Backdoor in ARVE WordPress Plugin
Wordfence discovers critical backdoor in ARVE WordPress plugin granting admin access via token.
A backdoored version 10.8.7 of the Advanced Responsive Video Embedder (ARVE) WordPress plugin was discovered by Wordfence, containing malicious code that could grant full administrator access through a single secret token. The vulnerability (CVE-2026-18072, CVSS 9.8) was detected within two hours of release and blocked by WordPress.org before automatic distribution to the plugin's ~20,000 active installations. The attacker likely gained commit access to the developer's account to introduce the backdoor, which transmitted compromised credentials to an attacker-controlled C2 server.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WordPress.org?
Get an email when a new story names WordPress.org, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA malicious version of the ARVE WordPress plugin was pushed to the official repository after an attacker compromised the developer's commit credentials, embedding a backdoor capable of granting full administrator access via a hidden secret token. This is a classic software supply chain attack — the threat entered through a trusted distribution channel, meaning users who automatically update plugins would have silently received malware. Wordfence's rapid detection within two hours prevented mass compromise across ~20,000 sites, underscoring the critical role of runtime integrity monitoring. The incident also highlights how a single compromised developer account can weaponize an entire plugin ecosystem, making developer account security just as important as the code itself.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-18072
- domain — fontswp.com
- malware — ARVE WordPress Plugin v10.8.7 backdoor