What is the CVSS score of EUVD-2026-57888?

EUVD-2026-57888 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Arvow AI SEO Writer are affected by EUVD-2026-57888?

The Arvow AI SEO Writer WordPress plugin (versions 1.5.3 and earlier) contains an unauthenticated access control flaw allowing remote attackers to modify plugin-managed content and SEO configurations…

How to fix or mitigate EUVD-2026-57888?

Within 24 hours: identify all WordPress installations running Arvow AI SEO Writer version 1.5.3 or earlier and assess criticality; immediately deactivate the plugin on non-essential instances pending remediation. Within 7 days: evaluate alternative SEO management plugins and prepare migration plan; implement Web Application Firewall (WAF) rules to restrict unauthenticated access to plugin endpoints on instances where the plugin remains active; configure logging and monitoring for unauthorized requests to plugin API endpoints. Within 30 days: complete migration to an alternative plugin solution; conduct audit of SEO configuration and content integrity on affected sites; document any unauthorized modifications and assess brand or content impact.

Arvow AI SEO Writer EUVD-2026-57888

| CVE-2026-66469 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-wj2j-w9f3-mmhx

WordPress Authentication Bypass Wordpress Plugin Arvow Ai Seo Writer

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Plugin endpoint is network-reachable with no auth required per description and PR:N; write-only impact (I:H) with no data exposure or service disruption confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:31 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

AnalysisAI

Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Arvow AI SEO Writer is a WordPress plugin by developer Afonso Matos (CPE: cpe:2.3:a:afonso_matos:arvow_ai_seo_writer:*:*:*:*:*:*:*:*) that provides AI-assisted SEO writing functionality. The root cause is CWE-862 (Missing Authorization): WordPress plugins are required to explicitly verify caller permissions - typically via current_user_can() - before executing privileged actions exposed through REST API endpoints, AJAX handlers, or admin-post hooks. When these checks are absent, any HTTP request, authenticated or not, can trigger restricted plugin functionality. This class of flaw is endemic to the WordPress plugin ecosystem and is consistently one of the most reported vulnerability types by Patchstack.

RemediationAI

Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/journalist-ai/vulnerability/wordpress-arvow-ai-seo-writer-plugin-1-5-3-broken-access-control-vulnerability for a confirmed patched release and upgrade to it immediately once available - no exact patched version has been independently verified at time of analysis. As an immediate compensating control, deactivating or uninstalling the Arvow AI SEO Writer plugin eliminates the attack surface entirely with no collateral effect on other site functionality, and is the recommended interim action for any site where the plugin is not actively required. Alternatively, deploying a WordPress-aware web application firewall such as Patchstack Firewall or Wordfence with a virtual patch rule for this CVE can block exploitation of the unprotected endpoints, though this may interfere with legitimate plugin operation if the affected routes are also used by authenticated users. Restricting public HTTP access to WordPress admin and AJAX endpoints at the network perimeter is an additional layer but will not protect REST API endpoints that must remain publicly accessible.