The ARVE plugin has been taken down, not by me, but by automated systems. It seems thankfully this was caught quickly.
YOU ARE MOST LIKELY SAFE! (Only 10.8.7 and 10.8.8 have the backdoor!)
- If you not manually downloaded the plugin in that very short time-frame it was available for manual download, as in clicking the download button on wordpress.org you did not get 10.8.7 or 10.8.8
- If you do not use some sort of 3rd party distribution that does get updates from wp.org earlier than their 24h cooldown period. (Could not tell you what they are, if they exist at this point)
- If you not manually or in any kind of automated way got the plugin from Github directly. AFAIK basically nobody does this, but there is a possibility.
Then you are secure. You may want to double check if you have 10.8.7 or 10.8.8 installed anyway.
If however those points do not all apply do you, if you downloaded manually around 2026-07-28 (time zones) you must check if you got it and if you were this unlucky please consult your host and people who can help you deal with the situation.
The WordFence article encourages users to delete the plugin and uses a lot of fear-mongering to upsell their security plugin. I am glad this was caught but why? They know almost nobody even got the malicious version, and they know wp.org will never restore a version that has the malicious code in it, so why exactly should people delete the plugin now? Nobody needs to delete any version that is not affected, when the plugin eventually gets restored it will update to a version that is as safe to use as it always was!
The wp.org distribution holds plugins back up to 24 hours after release, and it seems they have automated systems and react to alerts during that time to prevent this kind of thing. We should all be very grateful this exists, this could have ended up a lot worse!
Please do not blame me, I hope the plugin is not tainted forever by this, but I started using AI, and it seems it went rogue on my code, could be something else, but I expect this was an AI model I used, the code was kind of smart, in one area, in another it was not. It was using things that were tailored to my specific code and release process. It used a ngt-cli@local email for git commits fake marked them as “co-authored by Cursor” (A popular, closed source, AI development editor that I never used).
Just to quickly address this, I am actively, stressed out, working on this and to eventually get the plugin restored at some point. There is no urgency it seems. But it feels like it is.
Already decided on a new and more secure release process to prevent things like this from happening again. No more automated commits by GitHub’s Continuous Integration (CI) runner’s is part of it.
If this is not written well or corporate enough for you, have your favorite AI rewrite it for you 😉 But keep a look-out for it injecting some malicious bullshit into whatever you do with it.
Maybe its human but seems pretty AI to me, seen it trying to find secrets in my code/system … even writing code comments like “find interesting files”. Wish us/me luck.
Leave a Reply