점검 대응긴급KEV 미등록
CVE-2026-18072
nico23 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 취약점
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no passw...
- 대응 우선순위
- 점검
- CVSS
- 9.8
- EPSS
- - 백분위 -
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.29