Live › vulnerability › CVE-2026-109930
Go to dashboardThe MAIO WordPress plugin before 7.3.22 accepts a credential that is published verbatim in its public source as a valid API key. An unauthenticated attacker can use it to download the stored crawl-analytics log, which includes each visitor's IP address, user agent and referer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MAIO WordPress plugin before version 7.3.22 are exposed, since the plugin's public source contains a key that grants access to its analytics data. The exposed data is crawl-analytics logs of visitor IP addresses, user agents and referers. Sites without the plugin, or already on 7.3.22 or later, can skip it.
No product ranges from the sources yet.
7.3.227.3.22 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
This page as .md · .json · in your agent: get_signal("CVE-2026-109930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.