If you received an email from me pointing you to this page, it is because your website appears to be running a version of Advanced Responsive Video Embedder (the WordPress plugin usually shown as ARVE, folder advanced-responsive-video-embedder) that was published with a backdoor in it. This page explains what happened, how to check which version you have, and what to do about it.

This one is different from an ordinary “please update” notice, in two ways that matter, so please read the next two paragraphs before doing anything else.

Your dashboard will not offer you a way out. No release repairs this, and WordPress.org closed the plugin on 28 July 2026, which means the update service no longer answers for it: your WordPress dashboard will say there is no update available while the backdoored code continues to load on every request to your site. The site looks perfectly healthy and is not. There is a clean version you can install by hand (10.8.9, covered below), but nothing will arrive on its own, and clicking “update” will not reach it.

The step that helps is to deactivate or delete the plugin. That stops the code from loading. Everything else on this page follows from that.

The issue is tracked as CVE-2026-18072.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit anything to it, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the ARVE plugin publishes. Everything I know about the backdoor itself came from comparing the plugin’s official release archives on WordPress.org against each other, not from your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

What happened

ARVE is a long-standing plugin for embedding videos, in the official directory for years and maintained in the open. What went wrong was not a coding mistake in the plugin: it was a compromise of the release channel. Someone was able to publish releases under the plugin’s name.

Two such releases went out on 28 July 2026:

  • 10.8.7, published at about 13:00 UTC.
  • 10.8.8, published about three hours later. 10.8.8 is not a fix. It contains the same backdoor, rewritten so that it sits inside the plugin’s legitimate files rather than in an obvious separate one. Its changelog does not mention 10.8.8 at all.

That second release is the reason this notice exists in the form it does. The natural reaction to “10.8.7 is bad” is to move to the next version up, and here the next version up is the same problem wearing better clothes.

  • 10.8.6 is the last release published before this happened, and it is clean.
  • 10.8.9 is that same clean code, re-issued. On 3 August 2026 version 10.8.6 was re-published unchanged under the higher number 10.8.9. It repairs nothing: the two are byte-for-byte identical apart from the version strings, and the plugin’s own changelog says so. But because 10.8.9 sits above the two bad releases, installing it is an ordinary upgrade rather than a downgrade. It is the version to move to.

What the backdoor does

Stated at the level of detail that is useful to you as a site owner, and no further:

  • It installs an unconditional request handler, meaning code that examines every request to your site, including from visitors who are not logged in.
  • When a request carries a particular value, the handler logs that visitor in as an administrator of your WordPress site. The value in question is derived from public information about the site, so it is not a per-site secret that an attacker would first have to steal.
  • It also sends your site’s address and the plugin version out to a third-party server (the host fontswp[.]com, written here with brackets so nobody visits it by accident).

I am deliberately not publishing the exact value or the code that produces it. The affected archives are still downloadable, and a recipe would help the wrong people faster than it would help you.

Am I affected?

It comes down to one question: which version of ARVE is installed? You do not have to take my word for it, and there are two ways to check.

From the WordPress admin area (authoritative):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find ARVE or Advanced Responsive Video Embedder, the entry whose folder is advanced-responsive-video-embedder, and note the version shown beneath its name.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/advanced-responsive-video-embedder/readme.txt in a browser. The Stable tag: line near the top is the version your install reports, and this is the same public file I read.

Then apply this rule:

  • 10.8.7 or 10.8.8: affected. Act on the steps below.
  • 10.8.6 or older: clean, as far as the backdoor is concerned. Nothing here applies to you, though see the note about the plugin being closed.
  • 10.8.9: clean. It is 10.8.6 re-issued under a higher number.
  • Anything else, meaning a number above 10.8.9 or one that does not appear on this list, is not a release published in the official directory. Do not assume it is safe; ask me.

You can confirm the situation independently, without relying on anything I say: the plugin’s page in the official directory, Advanced Responsive Video Embedder, shows that it has been closed.

What to do

1. Deactivate or delete the plugin. In Plugins then Installed Plugins, deactivate ARVE. Deleting it as well is better if you can. This is the step that stops the code running, and it takes a few seconds. Do it before the rest.

On the command line, WP-CLI does the same:

wp plugin deactivate advanced-responsive-video-embedder
wp plugin delete advanced-responsive-video-embedder

2. Do not wait for an update to arrive. I said this at the top and it is worth saying twice, because it is the mistake this situation invites. No release fixes the flaw, the plugin has been closed so nothing will be offered to you automatically, and a dashboard reading “no updates available” is not evidence that anything is fine. The clean version in the next step has to be installed by hand.

3. If you actually need the video embeds, install 10.8.9. That release is clean and is downloadable:

https://downloads.wordpress.org/plugin/advanced-responsive-video-embedder.10.8.9.zip
sha256  faedfcb8502f5e92be1cae5d8fee063c8c599812afc79aac758dd1e9d090718f

Install it via Plugins then Add New Plugin then Upload Plugin. It is a file you upload, not a button you press, because the plugin is no longer listed in the directory. Check the sha256 checksum of the file you downloaded before installing it if you have the means to.

Be clear about what 10.8.9 is, because the number is misleading: it is not a repair. It is version 10.8.6, the last release from before this happened, re-published unchanged under a higher number. If you compare the two archives you will find nothing different but the version strings, and that is expected. The reason to prefer it over 10.8.6 is purely practical: it installs as an ordinary upgrade, and some managed hosts refuse to install an older version over a newer one.

If you would rather install 10.8.6 itself, it is equally clean and still downloadable:

https://downloads.wordpress.org/plugin/advanced-responsive-video-embedder.10.8.6.zip
sha256  39770f49365ef2c60a4d074ae13389bc7ccbf6c1a5f33c52b418e4b15943c83f

Either way, bear in mind that this plugin will receive no further updates while it remains closed, so treat it as a way to keep your pages working while you look for a replacement, not as a permanent arrangement.

4. Treat the site as potentially compromised. Because the code grants administrator access to anyone who asks in the right way, and because it was live on your site for however long the affected version was installed, the prudent assumption is that someone could have used it. I am not telling you that your site was broken into: I have no visibility into that, and I did not look. This is precaution, and it is the ordinary response to a backdoor that has been running in public.

If you want a proper investigation, take a full backup and preserve your web server access logs before you change anything, since deactivating the plugin and rotating credentials will overwrite some of what an investigator would want to see.

Then:

  • Regenerate the secret keys and salts in wp-config.php. New values are one click away at the official secret-key generator. Swapping them invalidates every existing login session, including any an intruder holds.
  • Reset the passwords on all administrator accounts.
  • Review the list of administrator accounts for any you do not recognise. Pay particular attention to usernames beginning wpsvc_, developer_, dev_ or wp_update_: the 10.8.7 code deliberately skipped over accounts named that way when it picked an account to log in as, which suggests those names were expected to be present.
  • Look for anything else unfamiliar: user accounts of any role, plugins you did not install, and scheduled tasks (WP-Cron entries) you do not recognise.

If your hosting provider offers a malware scan or a security review, this is a reasonable moment to take them up on it.

What I did and did not do

To be fully transparent about the check behind my email: I only read public files that your site already serves to every visitor, specifically the ARVE plugin’s public readme.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site. I did not send the backdoor’s trigger value, or anything else, to your site.

Everything I know about what the backdoored releases contain came from downloading the plugin’s official release archives from WordPress.org and comparing them with each other. I did not run that code, test it, or exploit it anywhere.

This is a version-based observation: your site reports a version that was published with the backdoor in it. It is not a statement that your site was exploited, and it is not an incident report about your site.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly, and step 1 is the urgent one.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin