CVE-2026-109930: MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MAIO WordPress pluginto a version that resolves this vulnerability.Fixed in 7.3.22
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the MAIO WordPress plugin in a version earlier than 7.3.22 are affected. An attacker can access the disclosed analytics data remotely without authentication.
What information can an attacker obtain?
An attacker can retrieve the stored crawl-analytics log. The log may contain recorded visitors' IP addresses, user-agent strings, and referer values.
Does exploitation require a WordPress account or user interaction?
No. The issue is exploitable without authentication or user interaction because the plugin accepts a credential value embedded in its publicly available source as a valid API key.