CVE-2026-18072
The Advanced Responsive Video Embedder plugin for WordPress contains a hardcoded backdoor that lets anyone log in as an administrator without a password. The flaw is in version 10.8.7 and allows attackers to gain full control of the site. It is a critical vulnerability that can be exploited by simply supplying a known token.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the Advanced Responsive Video Embedder plugin, specifically version 10.8.7.
Real-world impact
An attacker can authenticate as any administrator, giving them the ability to modify site content, install malicious plugins, and compromise the entire WordPress installation.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability requires no authentication, has no user interaction, and provides complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources