{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3043",
  "modified": "2026-08-11T12:00:00Z",
  "published": "2026-08-11T12:00:00Z",
  "summary": "Supply-chain backdoor in the WordPress plugin Advanced Responsive Video Embedder (10.8.7)",
  "details": "Advanced Responsive Video Embedder (WordPress, version 10.8.7, ~70k active installs) shipped with an injected file php/fn-update-check.php that turns any visitor into an administrator by hitting /?_wplogin=<32+ chars> with the correct HMAC or a hardcoded SHA-256 — and beacons every site's URL + admin login back to a fixed C2 host. Confirmed by version-diff against the clean predecessor 10.8.6 (in our archived corpus). Publicly assigned CVE-2026-18072 (CVSS 9.8). Fixed in 10.9.4 — the file is removed.",
  "affected": [
    {
      "package": {
        "ecosystem": "WordPress",
        "name": "advanced-responsive-video-embedder"
      },
      "versions": [
        "10.8.7"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3043-arve-backdoor"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3043",
    "kind": "malware",
    "class": "Supply-chain backdoor · magic-login + C2 beacon",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:16fa10e1f426270cca3797adf66c5bca5ec339348be20613851252bc4b060f34",
        "sha256:35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900"
      ],
      "indicators": [
        "Injected file SHA-256: 16fa10e1f426270cca3797adf66c5bca5ec339348be20613851252bc4b060f34",
        "File path: advanced-responsive-video-embedder/php/fn-update-check.php (not present in 10.8.6 or 10.9.4)",
        "C2 host: fontswp[.]com (defanged)",
        "C2 URL: https://fontswp[.]com/arve/cb.php?s=<site>&u=<admin>&v=<host> (defanged; sslverify=false)",
        "Hardcoded backdoor SHA-256: 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900",
        "Trigger: HTTP request with _wplogin or _wpm parameter (≥32 chars, matching HMAC or the hardcoded SHA-256)",
        "Registered hooks: init (priority 1) + admin_init (priority 99)",
        "Skipped username prefixes: wpsvc_, developer_, dev_, wp_update_",
        "Public CVE: CVE-2026-18072 (CVSS 9.8, CWE-506 + CWE-288)"
      ]
    }
  }
}