Advanced Responsive Video Embedder For Rumble Odysee Youtube Vimeo Kick
Monthly
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.