The Advanced Responsive Video Embedder plugin, version 10.8.7, contains a hardcoded SHA‑256 hash that can be supplied in the "_wplogin" (or "_wpm") query parameter. Because the plugin’s init hook runs before authentication checks and performs no nonce, capability or password validation, any visitor can send a crafted HTTP request containing the known token and be logged in as an arbitrary administrator. The attack grants full administrative privileges, allowing an attacker to modify site content, install additional malware, or exfiltrate data. The flaw is a direct authentication bypass via a backdoor embedded in the source code.

WordPress sites that have the Advanced Responsive Video Embedder plugin version 10.8.7 installed – the plugin is distributed by the vendor nico23. Only this specific version is confirmed to carry the backdoor; newer or older releases have not been reported as vulnerable.

The issue is rated CVSS 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting a low current exploitation probability, yet the exploit is trivial to launch, requiring just an HTTP request with the correct parameter. It is not listed in the CISA KEV catalog, but the high impact makes it a priority for any site operator. Attackers can acquire the necessary token from the publicly viewable source file, so the risk is high as long as the vulnerable plugin remains in use.