What is the CVSS score of CVE-2026-16257?

CVE-2026-16257 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Arvow AI SEO Writer are affected by CVE-2026-16257?

The Arvow AI SEO Writer WordPress plugin contains an unauthenticated vulnerability affecting unconfigured or abandoned instances, enabling attackers to inject content and compromise author accounts.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16257?

Yes, a public proof-of-concept exploit is available for CVE-2026-16257. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16257?

Within 24 hours, audit all WordPress instances to identify Arvow AI SEO Writer plugin installations and their versions, prioritizing unconfigured or abandoned deployments. Over the next 7 days, update affected instances to version 1.5.4 or later and verify the plugin has been properly configured post-installation. Within 30 days, remove the plugin from abandoned or unused sites and document remediation completion across the organization.

Arvow AI SEO Writer CVE-2026-16257

EUVD-2026-55037 HIGH

Improper Authentication (CWE-287)

2026-08-10 WPScan

GHSA-qhv8-f57q-hvv7

WordPress Authentication Bypass Arvow Ai Seo Writer Unknown

8.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

REST endpoint is network-accessible with no authentication (AV:N, PR:N); unconfigured-state condition does not raise AC given commonality of post-install default; C:L for author/taxonomy disclosure, I:H for arbitrary post creation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:28 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

8.2 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.2

DescriptionCVE.org

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

AnalysisAI

Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.

Technical ContextAI

The vulnerability resides in a REST API endpoint exposed by the Arvow AI SEO Writer WordPress plugin (CPE: cpe:2.3:a:unknown:arvow_ai_seo_writer:*:*:*:*:*:*:*:*). The root cause is CWE-287 (Improper Authentication), manifesting as a PHP type juggling flaw where loose comparison operators ( instead of =) allow a type mismatch to evaluate as truthy, effectively bypassing the endpoint's sole access control check. This class of flaw is endemic to WordPress plugins that implement custom authentication gates without strict equality enforcement. Because the bypass is conditional on the plugin being unconfigured, the vulnerable code path likely checks an unset or default configuration value using loose comparison against a crafted attacker-controlled input - a classic PHP juggling primitive. The REST endpoint is network-accessible without prior authentication.

RemediationAI

Upgrade to Arvow AI SEO Writer version 1.5.4 or later, which is the vendor-released patch confirmed by WPScan and EUVD-2026-55037 (https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/). As an immediate compensating control, configuring the plugin removes the exploitable condition entirely, since the type juggling bypass applies only in the unconfigured state - administrators who have already configured the plugin are not exposed to this specific attack path. If the plugin is not actively required, deactivating or removing it eliminates the attack surface with no operational trade-off. Blocking unauthenticated external access to WordPress REST API endpoints at the WAF or reverse proxy layer is a broader defensive measure but may break legitimate plugin functionality and should be tested before deployment.