External risk intelligence

WordPress Advanced Responsive Video Embedder Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18072

The vulnerability affects a WordPress plugin, which is typically used to enhance public-facing web applications. Because the vulnerable code executes on every request to the WordPress site, it is reachable by any unauthenticated user accessing the website over the public internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a WordPress plugin that embeds videos, specifically the Advanced Responsive Video Embedder. This vulnerability, if exploited, could allow unauthenticated attackers to gain full administrative control over affected websites by bypassing normal login procedures. The core issue stems from a hardcoded backdoor within the plugin's code, effectively providing universal administrator credentials.

Flaw allows unauthorized admin access to websites.
Confirms a potential significant risk to site integrity.
Assess plugin usage and confirm exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a hardcoded backdoor in the video embedder plugin. This backdoor allows an unauthenticated user to supply a specific token, which the plugin validates against a hardcoded hash. Successful validation grants the attacker administrative privileges on the WordPress site, enabling them to take full control.

Unauthenticated access to the website is required.
A specially crafted request with a specific token triggers the vulnerability.
Risk of full administrative control over the site.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication and gain full administrative control over an affected WordPress site. This could happen when the plugin is used in conjunction with a WordPress site.

WordPress administrative access.
Bypass authentication and execute code.
Full site compromise and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in the WordPress plugin. The first practical step involves identifying all WordPress instances using this plugin, confirming their reachability and business criticality, and then locating the accountable owner for remediation planning.

WordPress application owners should own this.
Verify plugin installation and site reachability.
Plan vendor coordination or plugin removal.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advanced Responsive Video Embedder plugin?

This WordPress plugin allows site owners to easily display video content from popular streaming platforms like YouTube, Vimeo, and Kick within their posts or pages. It functions by embedding the necessary player code so visitors can watch content directly on the site, helping creators maintain engagement without requiring users to navigate away to external video hosting services.

How does CVE-2026-18072 allow an authentication bypass?

The flaw is categorized as CWE-506, which refers to the inclusion of malicious code—in this case, a hardcoded backdoor. The plugin automatically checks every incoming web request for a specific token that matches a secret, pre-written value inside the plugin's source files. By supplying this known token, an attacker forces the software to treat them as an administrator, completely circumventing standard login security.

Do I need to be logged in to trigger this vulnerability?

No. The vulnerability does not require any prior access or legitimate credentials to trigger. Because the plugin processes the malicious request before any standard security checks occur, simply sending a specially crafted web request to a site running the affected version is sufficient. Normal, non-administrative interactions with the site do not trigger the bug; it requires the deliberate submission of the specific token recognized by the backdoor.

How does Halo Surface Signal determine if I am at risk?

Halo Surface Signal identifies this as a highly relevant issue because the plugin is designed for public-facing websites. Since the vulnerable code runs on every request, any unauthenticated user visiting your site over the internet can attempt to trigger the backdoor. Sites that are reachable from the public web are at greater risk compared to internal-only systems, as the attack path is natively exposed to the internet.

What should I do if my site uses this plugin?

Your immediate priority is to identify every WordPress installation under your management that has this specific plugin installed. Since this flaw allows for total site takeover, you should evaluate whether the plugin is essential for your operations. If it is not strictly required, remove it entirely as a precaution. If you must use the plugin, coordinate with your technical team to verify if a secure version is available or seek an alternative solution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.