MEDIUM 5.3 NVD

CVE-2026-109930

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.

References

https://wpscan.com/vulnerability/45887eb3-93f9-4345-a72a-de627f23820c/

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-16 via NVD.

vulnfeed aggregates 16278 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.