CVE-2026-18072: Unauth Auth Bypass in Advanced Responsive Video Embedder 10.8.7 via Hardcoded Backdoor

Vulnerability Overview Vulnerability Name: Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick ... 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter CVE ID: CVE-2026-18072 CVSS Score: 9.8 (Critical) Publication Date: July 28, 2026 Last Updated: July 29, 2026 Researcher: Wordfence PRISM - Wordfence Impact Scope Software Type: Plugin Software Slug: advanced-responsive-video-embedder Affected Versions: 10.8.7 Remediation Patch Status: No known patch available Recommended Actions: Review the vulnerability details thoroughly and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Vulnerability Description This vulnerability exists in version 10.8.7 of the Advanced Responsive Video Embedder plugin. The flaw is located in the function, which is registered on WordPress’s “init” hook with a priority of 1, causing it to execute before authentication checks for every request. Attackers can bypass authentication by providing a hardcoded SHA-256 hash extracted from the (or ) parameter, bypassing nonce verification, capability checks, and password validation. Since this static hash contains a set of publicly accessible generic credentials, an unauthenticated attacker can leverage a known token to authenticate as any selected administrator account, thereby gaining full administrative control over the affected WordPress site. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Sharing Options Facebook X (Twitter) LinkedIn Email Additional Information Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration, to help you stay up-to-date with the WordPress vulnerability database. Wordfence Intelligence WordPress Vulnerability Database: Provides fully free access and querying capabilities, including API access and documentation. Footer Information Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Subscription Stay Updated: Subscribe to news and updates, and receive information from experienced security professionals via our dashboard. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Social Media X Facebook Instagram YouTube Products and Services Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Form Email: you@example.com Checkbox: By checking this box I agree to the terms of service and privacy policy. Subscription Button SIGN UP Partners CRESCENT Summary This vulnerability is a critical security issue that allows unauthenticated attackers to bypass authentication via a hardcoded backdoor, gaining full administrative access. No known patch is currently available. Users are advised to implement mitigation measures as soon as possible, such as uninstalling the affected software or seeking alternatives.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18072: Unauth Auth Bypass in Advanced Responsive Video Embedder 10.8.7 via Hardcoded Backdoor

More from this source