WordPress Plugin Vulnerabilities

Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling

Description

The plugin does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the plugin has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.

Proof of Concept

Affects Plugins

Plugin icon
journalist-ai
Fixed in 1.5.4

References

CVE
CVE-2026-16257

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
8.2 (high)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Verified
Yes
WPVDB ID
89c32854-1cf1-4fe9-a6d0-6244be2dcc03

Timeline

Publicly Published
2026-08-05 (about 5 days ago)
Added
2026-08-05 (about 4 days ago)
Last Updated
2026-08-05 (about 4 days ago)

Other

Published
Title
Published
2024-03-11
Title
Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access
Published
2026-07-23
Title
WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.07 - Two-Factor Authentication Bypass
Published
2021-11-02
Title
WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Arbitrary Post Deletion
Published
2026-05-28
Title
CloudSecure WP Security < 1.4.8 - Two-Factor Authentication Bypass
Published
2020-03-26
Title
IMPress for IDX Broker < 2.6.2 - Authenticated Post Creation, Modification, and Deletion