The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 16 Oct 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer. | |
| Title | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-16T11:08:03.380Z
Reserved: 2026-10-13T10:50:53.548Z
Link: CVE-2026-109930
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-16T12:16:32.273
Modified: 2026-10-16T12:16:32.273
Link: CVE-2026-109930
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.