CVE-2026-16257
Received Received - Intake

Unauthenticated Post Creation in Arvow AI SEO Writer WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-16257
EUVD
EUVD-2026-55037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arvow ai_seo_writer to 1.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Arvow AI SEO Writer WordPress plugin before version 1.5.4 has an improperly restricted REST endpoint that allows unauthenticated users to bypass access controls through type juggling when the plugin is not configured. This enables attackers to create arbitrary posts or pages and disclose author account and taxonomy information.

Detection Guidance

Check the installed version of the Arvow AI SEO Writer plugin in your WordPress admin panel. If it is below 1.5.4, the vulnerability is likely present. You can also inspect network traffic for unauthorized REST API requests to the affected endpoint.

Impact Analysis

Unauthenticated attackers could exploit this to create unauthorized posts or pages on your WordPress site and access sensitive information like author details and taxonomy data. This could lead to content manipulation, data leaks, or further attacks on your site.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized content creation may also breach compliance policies.

Mitigation Strategies

Update the Arvow AI SEO Writer plugin to version 1.5.4 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart