CVE-2026-109930

LOWCVSS 5.3 · MEDIUM

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/45887eb3-93f9-4345-a72a-de627f23820c/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

CVE@CVEnew1d
CVE-2026-109930 The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public sour… https://www.cve.org/CVERecord?id=CVE-2026-109930
00010997
58.2K followersView on X

Explore more

Back to dashboard