CVE-2026-16257 Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
Unauthenticated attackers can bypass access controls via type juggling to create arbitrary posts and disclose sensitive information in the Arvow AI SEO Writer plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16257?
CVE-2026-16257 is a high-severity authentication bypass vulnerability in Unknown Arvow AI SEO Writer, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
Weakness: CWE-287
Which versions are affected by CVE-2026-16257?
How do I fix CVE-2026-16257?
No fix has been published for CVE-2026-16257 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-16257 being exploited?
There is no known exploitation of CVE-2026-16257 in the wild and no public exploit code.
Sources
Also known as GHSA-qhv8-f57q-hvv7.