A critical authentication bypass vulnerability in the Advanced Responsive Video Embedder plugin allows unauthenticated users to gain full administrative control over WordPress sites.

The plugin contains a hardcoded SHA-256 hash that acts as a universal credential. Because the check occurs on the WordPress init hook without any capability or nonce verification, an unauthenticated attacker can supply the token to impersonate an administrator.

With a CVSS score of 9.8, this vulnerability represents a total security failure. An attacker gaining administrative access can install malicious plugins, exfiltrate user data, or use the site to host further malicious content, leading to complete site compromise and potential loss of customer trust.

Immediate Action: Remove the plugin from all WordPress installations immediately as no patched version is currently identified.

Proactive Monitoring: Audit user accounts for unauthorized additions or modifications, and review server access logs for requests containing the _wplogin or _wpm parameters.

Compensating Controls: Disable the plugin entirely and implement a Web Application Firewall to block requests targeting the identified vulnerable parameters.

Public Exploit Available: No (exploit_available: false)

This vulnerability is severe and requires immediate removal of the affected plugin. Since the flaw involves a hardcoded backdoor, it is recommended to conduct a full security audit of the affected WordPress site to ensure no persistent backdoors or malicious accounts were created during the exposure window.