WordPress Plugin Backdoor Sends Site and Administrator Details to Attacker C2

Cybersecuritynews •Abinaya • July 29, 2026

A critical supply chain backdoor in the Advanced Responsive Video Embedder WordPress plugin, which can give unauthenticated attackers complete administrator access. The malicious version, 10.8.7, affects a plugin with roughly 20,000 active installations and is tracked as CVE-2026-18072, with a CVSS score of 9.8. The issue was detected by Wordfence PRISM, the company’s autonomous AI […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Backdoor in WordPress Plugin Affects 20,000 Sites A severe supply chain compromise in the Advanced Responsive Video Embedder WordPress plugin has been identified, allowing unauthenticated attackers to gain complete administrator access. The malicious version, 10.8.7, impacts around 20,000 active installations and is tracked as CVE-2026-18072, with a CVSS score of 9.8. The backdoor enables attackers to bypass authentication without any user interaction. This vulnerability was detected by Wordfence's AI threat intelligence system, PRISM. Website owners are urged to take immediate action to secure their sites. The issue was published on 2026-07-29, highlighting the urgency of the situation. 2 sources 73

Extracted Entities

WordPress Plugin Backdoor Sends Site and Administrator Details to Attacker C2

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)