A hidden token in a WordPress plugin can hand over the whole site before normal login checks even run. This is not a broken password flow. It is a built-in trust shortcut that lets an unauthenticated attacker present a known value and be accepted as an existing admin account. Wordfence PRISM disclosed CVE-2026-18072 in Advanced Responsive Video Embedder v10.8.7. The flaw lets an attacker use the '_wplogin' parameter to authenticate as an arbitrarily chosen administrator, and there is no patch available. For site operators, the real issue is that the published fix path is removal, not cleanup. Once the plugin is present, it creates a direct path to admin control, so the site stays exposed until the code is gone.