PT-2026-115579

CVE-2026-109930

Published

2026-10-15

Updated

2026-10-20

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MAIO WordPress plugin versions prior to 7.3.22

Description Insufficient access restrictions to analytics data allow unauthenticated attackers to retrieve the stored crawl-analytics log. This occurs because the plugin treats a credential value included in its public source code as a valid API key. The exposed data includes each recorded visitor's IP address, user agent, and referer.

Recommendations Update the MAIO WordPress plugin to version 7.3.22 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers