CVE-2026-109930
Deferred Deferred - Pending Action

MAIO WordPress Plugin Analytics Data Exposure Vulnerability

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-109930
EUVD
EUVD-2026-102837

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown MAIO 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MAIO WordPress plugin before version 7.3.22 has a vulnerability where it uses a hardcoded API key in its public source code as a valid credential. This allows unauthenticated attackers to access sensitive crawl analytics data, including visitor IP addresses, user agents, and referer information stored in logs.

Detection Guidance

Check if the MAIO WordPress plugin version is below 7.3.22 by inspecting the plugin files or WordPress admin panel. Look for hardcoded API keys in the plugin's public source code or configuration files.

Impact Analysis

Unauthenticated attackers can retrieve stored visitor data such as IP addresses, user agents, and referer details. This exposes sensitive information about website visitors without requiring any authentication or user interaction.

Compliance Impact

This vulnerability could lead to non-compliance with privacy regulations like GDPR or HIPAA, as it allows unauthorized access to personally identifiable information (PII) such as IP addresses and user agents without consent or proper safeguards.

Mitigation Strategies

Update the MAIO WordPress plugin to version 7.3.22 or later immediately to patch the vulnerability. Remove any hardcoded API keys from the plugin's source code if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart