The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Ba…

CVE-2026-18072 affects the Advanced Responsive Video Embedder WordPress plugin version 10.8.7, which contains a hardcoded backdoor enabling full authentication bypass. The vulnerability resides in the `_arve_uc_init()` function, registered at WordPress `init` hook priority 1, which runs before any authentication checks. An attacker-supplied token via `_wplogin` or `_wpm` parameters is compared against a hardcoded SHA-256 hash embedded in the plugin source code. This allows unauthenticated attackers to authenticate as any existing administrator account without any nonce, capability, or password validation. The backdoor was likely introduced through a supply chain attack where a threat actor gained commit access to the developer's account. The vulnerability grants full administrative control over affected WordPress sites. Given the publicly accessible nature of the hardcoded hash in the plugin source, exploitation is trivial and highly likely.