CVE-2026-18072 is an authentication bypass vulnerability in the Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … WordPress plugin version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function, hooked early in WordPress's initialization process, reads a token from the `_wplogin` or `_wpm` parameter and compares it against a hardcoded SHA-256 hash embedded in the plugin source code. This static hash acts as a universal credential, allowing unauthenticated attackers who know the token to authenticate as any existing administrator account without any nonce, capability, or password checks. The backdoor was likely introduced by an attacker who gained commit access to the developer's repository. The CVSS v3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

An unauthenticated attacker can bypass all authentication mechanisms and gain full administrative control over the affected WordPress site. This allows complete compromise of the site, including content modification, user account control, and potential further pivoting within the hosting environment. The vulnerability is critical due to the ease of exploitation (no authentication or user interaction required) and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should immediately consider disabling or removing the affected plugin version 10.8.7 until a trusted update is released. Monitor official vendor channels for updates. Given the nature of the vulnerability as a hardcoded backdoor, replacing the plugin with a clean, verified version or alternative is recommended once available.