MAIO WordPress Plugin CVE-2026-109930

The target site must run the MAIO WordPress plugin at a version before 7.3.22 with its crawl-analytics logging in use so that visitor records exist to disclose. The only 'prerequisite' is knowledge of a credential value that the plugin ships verbatim in its own publicly distributed source code, which the plugin accepts as a valid API key - so there is effectively no authentication barrier and no non-default configuration is required. Limiting factors are the scope of impact rather than access: exploitation yields only stored visitor telemetry (IP address, user agent, referer), not credentials, admin access, or write capability, and the flaw grants no integrity or availability impact.

This is a moderate-severity information disclosure flaw whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 5.3) describes remote, unauthenticated, low-complexity access with only limited confidentiality impact (C:L, I:N, A:N) - a realistic reflection of the issue, since the plugin accepts a credential value hard-coded verbatim in its own publicly readable source as a valid API key, effectively making the 'authentication' decorative. A publicly available exploit exists (WPScan), which raises practical exploitability, but no CISA KEV listing and no EPSS score were provided, so there is no evidence of active or widespread exploitation at this time; the POC signal and the absence of KEV are distinct and should not be conflated. The realistic ceiling of harm is disclosure of stored crawl-analytics (visitor IP, user agent, referer) - reconnaissance/privacy-grade data, not credentials or code execution - so despite trivial exploitability this is a lower priority than a 5.3 with integrity or availability impact would be. Net: a genuine but bounded issue - patch in normal cycles, prioritize if the site handles sensitive visitor populations. EPSS and SSVC data were not supplied and could not be factored in.

An unauthenticated attacker reads the MAIO plugin's public source to obtain the hard-coded API key value, then sends a single crafted request to the plugin's analytics endpoint supplying that key. The server returns the stored crawl-analytics log, exposing every recorded visitor's IP address, user agent, and referer. A public exploit for this is available via WPScan, and the low attack complexity (AC:L) means it requires no special timing or conditions.