CVE-2026-16257

HighCVSS 8.2

Published: 10/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the plugin has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

Risk Assessment

Risk of unauthorized content creation on the site and disclosure of author and taxonomy data.

Recommendation

Update the Arvow AI SEO Writer plugin to version 1.5.4 or later and configure it.

Other vulnerabilities in Arvow AI SEO Writer

CVE-2026-66469High
Unauthenticated Broken Access Control in Arvow AI SEO Writer plugin versions up to 1.5.3. An attacker without authentication can access functions that should be protected.

Original NVD description (English source)

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.