The Arvow AI SEO Writer WordPress plugin versions prior to 1.5.4 contain an improper authentication vulnerability (CWE-287) in one of its REST API endpoints. The endpoint's access control can be bypassed by unauthenticated users via type juggling when the plugin is unconfigured, enabling unauthorized creation of posts and pages and disclosure of sensitive author and taxonomy data. This vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability.

An attacker can exploit this vulnerability remotely without authentication to create arbitrary content on the affected WordPress site and access sensitive author and taxonomy information. This compromises the integrity and confidentiality of the site content and user data. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected REST endpoint through additional access controls or disabling the plugin if not in use may reduce risk.