[ CVE-2026-109930 · Published 16 Oct 2026 ]
Vulnerability in Unknown MAIO
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.