[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSUMguxHqZGV8hvj0MxdeQ6SmLpWGnULEN4gNGCyYSV8":3},{"article":4,"iocs":44,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"d1accfd8-0af9-46c8-9c12-5336f42d3b4a","Wordfence Finds Critical Backdoor in ARVE WordPress Plugin","wordfence-finds-critical-backdoor-in-arve-wordpress-plugin-40b045","A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites.","A backdoored version 10.8.7 of the Advanced Responsive Video Embedder (ARVE) WordPress plugin was discovered by Wordfence, containing malicious code that could grant full administrator access through a single secret token. The vulnerability (CVE-2026-18072, CVSS 9.8) was detected within two hours of release and blocked by WordPress.org before automatic distribution to the plugin's ~20,000 active installations. The attacker likely gained commit access to the developer's account to introduce the backdoor, which transmitted compromised credentials to an attacker-controlled C2 server.","Wordfence discovers critical backdoor in ARVE WordPress plugin granting admin access via token.","https:\u002F\u002Fhackread.com\u002Fwordfence-critical-backdoor-arve-wordpress-plugin\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fwordfence-critical-backdoor-arve-wordpress-plugin.jpg","2026-07-31T13:07:14+00:00","2026-07-31T14:00:19.275388+00:00",9,[17,20,23,25],{"name":18,"type":19},"ARVE (Advanced Responsive Video Embedder)","product",{"name":21,"type":22},"WordPress.org","vendor",{"name":24,"type":22},"Wordfence",{"name":26,"type":27},"WordPress","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[45,49,53],{"type":46,"value":47,"context":48},"cve","CVE-2026-18072","Critical backdoor in ARVE WordPress plugin v10.8.7",{"type":50,"value":51,"context":52},"domain","fontswp.com","Attacker-controlled command-and-control server receiving admin credentials",{"type":32,"value":54,"context":55},"ARVE WordPress Plugin v10.8.7 backdoor","Malicious plugin version with admin access vulnerability",[21,24,18],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":165},"backdoored-wordpress-plugin-highlights-software-supply-chain-risks","Backdoored WordPress Plugin Highlights Software Supply Chain Risks","A malicious version of the ARVE WordPress plugin was pushed to the official repository after an attacker compromised the developer's commit credentials, embedding a backdoor capable of granting full administrator access via a hidden secret token. This is a classic software supply chain attack — the threat entered through a trusted distribution channel, meaning users who automatically update plugins would have silently received malware. Wordfence's rapid detection within two hours prevented mass compromise across ~20,000 sites, underscoring the critical role of runtime integrity monitoring. The incident also highlights how a single compromised developer account can weaponize an entire plugin ecosystem, making developer account security just as important as the code itself.",[152,153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 16 – Application Software Security","NIST SP 800-161 – Supply Chain Risk Management","NIST AC-2 – Account Management","NIST AC-6 – Least Privilege","NIST IA-5 – Authenticator Management (MFA)","NIST SI-7 – Software, Firmware, and Information Integrity","NIST SR-11 – Component Authenticity","GDPR Article 32 – Security of Processing (where personal data is handled by affected sites)","OWASP A06:2021 – Vulnerable and Outdated Components","OWASP A08:2021 – Software and Data Integrity Failures",{}]