CVE-2026-109930 MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
Unauthenticated attackers can retrieve sensitive crawl analytics data, including visitor IPs and user agents, due to a hardcoded API key in the MAIO WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109930?
CVE-2026-109930 is a medium-severity vulnerability in Unknown MAIO, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
Weakness: CWE-200
Which versions are affected by CVE-2026-109930?
How do I fix CVE-2026-109930?
No fix has been published for CVE-2026-109930 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109930 being exploited?
There is no known exploitation of CVE-2026-109930 in the wild and no public exploit code.
Sources
Also known as GHSA-rc38-42pj-ccjg.