CVE-2026-16257
Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
- State
- Published
- Severity
- 8.2 High
- Published
- Aug 10, 2026
- Updated
- Aug 11, 2026
- Reserved
- Jul 20, 2026
Description
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Arvow AI SEO WriterUnknown |
|
References
- https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.