Advanced Responsive Video Embedder 10.8.7 - 10.8.8 Unauthenticated Authentication Bypass via Hardcoded Backdoor

Description

The plugin was distributed with malicious code that provides a hardcoded backdoor, allowing unauthenticated attackers to authenticate as an arbitrarily chosen existing administrator account and gain full control of the site. The backdoor runs on the `init` hook at priority 1, before any authentication check, and accepts a token supplied via the `_wplogin` or `_wpm` request parameter, comparing it against a SHA-256 hash embedded in the plugin source — with no nonce verification, capability check or password validation. Because the hash is publicly readable in the shipped source, it acts as a set of universal credentials. Affected build: 10.8.7 (the backdoor was likely introduced by an attacker who gained commit access to the developer's wordpress.org account). The plugin was closed on wordpress.org on 2026-07-28; site owners running 10.8.7 should treat the site as compromised, remove the plugin, and audit administrator accounts and site integrity.