Arvow Ai Seo Writer
Monthly
Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.