Vulnerability · Published Aug 10, 2026 · Assigned by WPScan

CVE-2026-16257Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling

High 8.2

In plain English

A high-severity improper authentication in Arvow AI SEO Writer from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Arvow AI SEO Writer	0 – before 1.5.4

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

References

https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/ exploit, vdb-entry, technical-description