What’s Vulnerable › Vulnerabilities
CVE-2026-16257: Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-10 · updated 2026-08-26
- Weakness: CWE-287
Description
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
Affected products
- Arvow AI SEO Writer: before 1.5.4 — fixed in 1.5.4
How to fix
Upgrade to a fixed version: Arvow AI SEO Writer 1.5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16257 or the next vulnerability affects your stack