CVE-2026-16257CWE-287

CVE-2026-16257

High · published August 10, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
    cvelistv5