Attack Chain

1. Attacker identifies a target WordPress site running the Advanced Responsive Video Embedder plugin version 10.8.7.
2. Attacker obtains the publicly known hardcoded SHA-256 hash (acting as universal credentials) from the plugin's source code.
3. Attacker crafts an HTTP GET or POST request targeting the vulnerable WordPress instance.
4. The request includes a URL query parameter, either _wplogin or _wpm, containing the hardcoded SHA-256 token.
5. The WordPress init hook triggers the _arve_uc_init() function, which processes the attacker-supplied token from the URL parameter.
6. The _arve_uc_init() function validates the provided token against the internally hardcoded SHA-256 hash, bypassing all legitimate authentication mechanisms.
7. The attacker is successfully authenticated as an arbitrarily selected existing administrator account on the WordPress site without needing valid credentials.
8. Attacker gains full administrative control, enabling actions such as content modification, plugin/theme installation, data exfiltration, or further compromise of the web server.

Impact

Successful exploitation of CVE-2026-18072 grants unauthenticated attackers full administrative control over the affected WordPress site. This can lead to severe consequences including, but not limited to, complete website defacement, arbitrary code execution, exfiltration of sensitive data, creation of new malicious administrator accounts for persistence, and the use of the compromised site as a platform for further attacks (e.g., malware distribution, phishing campaigns). The exact number of victims is not specified, but any organization utilizing the vulnerable plugin version is at critical risk.

Recommendation

• Patch CVE-2026-18072 immediately by updating the "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …" plugin to a version greater than 10.8.7.
• Deploy the Sigma rule below to your SIEM to detect exploitation attempts of CVE-2026-18072, ensuring webserver logs are collected.
• Review webserver access logs for the presence of _wplogin or _wpm query parameters, as indicated in the Sigma rule.