CVE-2026-109930
CVE-2026-109930 · MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
CVSS 5.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
maio
- Versiones
- ≥ 0, < 7.3.22: Afectada (semver)
Actualiza a 7.3.22