CVE-2026-16257— Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Arvow AI SEO Writer | < 1.5.4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16257
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
Source: CVE Program / CVE List V5
Vulnerability Description
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Arvow AI SEO Writer 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Arvow AI SEO Writer是WordPress基金会开源的一款AI驱动的SEO内容创作插件。 WordPress Arvow AI SEO Writer 1.5.4之前版本存在安全漏洞，该漏洞源于对REST端点的访问控制不当，攻击者可通过类型 juggling 绕过访问控制，导致未认证用户能够创建任意文章和页面并泄露作者账户和分类信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Arvow AI SEO Writer | 0 ~ 1.5.4 | - |
II. Public POCs for CVE-2026-16257
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16257
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16257 (1)
Same Patch Batch · Unknown · 2026-08-10 · 48 CVEs total
| CVE-2026-17020 | Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclos | |
| CVE-2026-17023 | Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connecti | |
| CVE-2026-18786 | CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass | |
| CVE-2026-14293 | Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor | |
| CVE-2026-19075 | All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Param | |
| CVE-2026-19074 | Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom F | |
| CVE-2026-19089 | Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-19077 | Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Lev | |
| CVE-2026-14238 | Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report | |
| CVE-2026-17021 | Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total T | |
| CVE-2026-17022 | Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Discl | |
| CVE-2026-14211 | Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR | |
| CVE-2026-19053 | ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter | |
| CVE-2026-19049 | ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removes | |
| CVE-2026-18960 | Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords | |
| CVE-2026-18946 | Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictabl | |
| CVE-2026-18934 | RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Del | |
| CVE-2026-15229 | Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulatio | |
| CVE-2026-16949 | Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup | |
| CVE-2026-16985 | Squeeze < 1.7.12 - Author+ Arbitrary File Upload |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-19782
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure v - CVE-2026-19842
SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Adminis - CVE-2026-19709
Membership For WooCommerce < 3.1.2 - Unauthenticated Member - CVE-2026-19056
ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Pa - CVE-2026-19416
KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modifi
V. Comments for CVE-2026-16257
No comments yet