If you received an email from me pointing you to this page, it is because your website appears to be running a version of Advanced Responsive Video Embedder (the WordPress plugin usually shown as ARVE, folder advanced-responsive-video-embedder) that was published with a backdoor in it. This page explains what happened, how to check which version you have, and what to do about it.

This one is different from an ordinary “please update” notice, in two ways that matter, so please read the next two paragraphs before doing anything else.

Updating will not fix it. There is no fixed release. WordPress.org closed the plugin on 28 July 2026, which means the update service no longer answers for it: your WordPress dashboard will say there is no update available while the backdoored code continues to load on every request to your site. The site looks perfectly healthy and is not.

The step that helps is to deactivate or delete the plugin. That stops the code from loading. Everything else on this page follows from that.

The issue is tracked as CVE-2026-18072.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit anything to it, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the ARVE plugin publishes. Everything I know about the backdoor itself came from comparing the plugin’s official release archives on WordPress.org against each other, not from your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

What happened

ARVE is a long-standing plugin for embedding videos, in the official directory for years and maintained in the open. What went wrong was not a coding mistake in the plugin: it was a compromise of the release channel. Someone was able to publish releases under the plugin’s name.

Two such releases went out on 28 July 2026:

  • 10.8.7, published at about 13:00 UTC.
  • 10.8.8, published about three hours later. 10.8.8 is not a fix. It contains the same backdoor, rewritten so that it sits inside the plugin’s legitimate files rather than in an obvious separate one. Its changelog does not mention 10.8.8 at all.

That second release is the reason this notice exists in the form it does. The natural reaction to “10.8.7 is bad” is to move to the next version up, and here the next version up is the same problem wearing better clothes.

  • 10.8.6 is the last clean release, and the only clean release.
  • 10.8.9 does not exist. There is nothing newer to move to.

What the backdoor does

Stated at the level of detail that is useful to you as a site owner, and no further:

  • It installs an unconditional request handler, meaning code that examines every request to your site, including from visitors who are not logged in.
  • When a request carries a particular value, the handler logs that visitor in as an administrator of your WordPress site. The value in question is derived from public information about the site, so it is not a per-site secret that an attacker would first have to steal.
  • It also sends your site’s address and the plugin version out to a third-party server (the host fontswp[.]com, written here with brackets so nobody visits it by accident).

I am deliberately not publishing the exact value or the code that produces it. The affected archives are still downloadable, and a recipe would help the wrong people faster than it would help you.

Am I affected?

It comes down to one question: which version of ARVE is installed? You do not have to take my word for it, and there are two ways to check.

From the WordPress admin area (authoritative):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find ARVE or Advanced Responsive Video Embedder, the entry whose folder is advanced-responsive-video-embedder, and note the version shown beneath its name.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/advanced-responsive-video-embedder/readme.txt in a browser. The Stable tag: line near the top is the version your install reports, and this is the same public file I read.

Then apply this rule:

  • 10.8.7 or 10.8.8: affected. Act on the steps below.
  • 10.8.6 or older: clean, as far as the backdoor is concerned. Nothing here applies to you, though see the note about the plugin being closed.
  • There is no “10.8.9 or newer” case. Those versions do not exist.

You can confirm the situation independently, without relying on anything I say: the plugin’s page in the official directory, Advanced Responsive Video Embedder, shows that it has been closed.

What to do

1. Deactivate or delete the plugin. In Plugins then Installed Plugins, deactivate ARVE. Deleting it as well is better if you can. This is the step that stops the code running, and it takes a few seconds. Do it before the rest.

On the command line, WP-CLI does the same:

wp plugin deactivate advanced-responsive-video-embedder
wp plugin delete advanced-responsive-video-embedder

2. Do not try to update your way out of it. I said this at the top and it is worth saying twice, because it is the mistake this situation invites. There is no release that fixes the problem, the plugin has been closed so no update will be offered, and a dashboard reading “no updates available” is not evidence that anything is fine.

3. If you actually need the video embeds, go back to 10.8.6. That release is clean and is still downloadable:

https://downloads.wordpress.org/plugin/advanced-responsive-video-embedder.10.8.6.zip
sha256  4a3407669f2a28cd46c9b39e12ab939bfa5bfcb6231a2aaa4aabac28a8969321

Install it via Plugins then Add New Plugin then Upload Plugin. This is a downgrade, which is the opposite of the usual advice, so it is worth being clear that it is deliberate: in this one case the older release is the safe one. Check the sha256 checksum of the file you downloaded before installing it if you have the means to. Bear in mind that 10.8.6 will receive no further updates while the plugin remains closed, so treat it as a way to keep your pages working while you look for a replacement, not as a permanent arrangement.

4. Treat the site as potentially compromised. Because the code grants administrator access to anyone who asks in the right way, and because it was live on your site for however long the affected version was installed, the prudent assumption is that someone could have used it. I am not telling you that your site was broken into: I have no visibility into that, and I did not look. This is precaution, and it is the ordinary response to a backdoor that has been running in public.

If you want a proper investigation, take a full backup and preserve your web server access logs before you change anything, since deactivating the plugin and rotating credentials will overwrite some of what an investigator would want to see.

Then:

  • Regenerate the secret keys and salts in wp-config.php. New values are one click away at the official secret-key generator. Swapping them invalidates every existing login session, including any an intruder holds.
  • Reset the passwords on all administrator accounts.
  • Review the list of administrator accounts for any you do not recognise. Pay particular attention to usernames beginning wpsvc_, developer_, dev_ or wp_update_: the 10.8.7 code deliberately skipped over accounts named that way when it picked an account to log in as, which suggests those names were expected to be present.
  • Look for anything else unfamiliar: user accounts of any role, plugins you did not install, and scheduled tasks (WP-Cron entries) you do not recognise.

If your hosting provider offers a malware scan or a security review, this is a reasonable moment to take them up on it.

What I did and did not do

To be fully transparent about the check behind my email: I only read public files that your site already serves to every visitor, specifically the ARVE plugin’s public readme.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site. I did not send the backdoor’s trigger value, or anything else, to your site.

Everything I know about what the backdoored releases contain came from downloading the plugin’s official release archives from WordPress.org and comparing them with each other. I did not run that code, test it, or exploit it anywhere.

This is a version-based observation: your site reports a version that was published with the backdoor in it. It is not a statement that your site was exploited, and it is not an incident report about your site.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly, and step 1 is the urgent one.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin