Threat database

The Advanced Responsive Video Embedder plugin for WordPress version 10.8.7 contains a critical authentication bypass vulnerability due to a hardcoded backdoor token. This backdoor allows unauthenticated attackers to gain administrator privileges by supplying a known token that matches a hardcoded SHA-256 hash in the plugin source. The vulnerability arises because the authentication bypass occurs before any normal authentication checks, with no nonce or capability verification. This flaw was likely introduced maliciously by an attacker with commit access to the plugin's codebase.