Maio
Monthly
Unauthenticated information disclosure in the MAIO WordPress plugin before version 7.3.22 allows any remote attacker to retrieve the plugin's stored crawl-analytics log - including each recorded visitor's IP address, user agent, and referer - by presenting a credential value that ships verbatim in the plugin's own publicly distributed source as a valid API key. Because the accepted key is readable by anyone who downloads the plugin, there is effectively no authentication barrier: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and no non-default configuration is required beyond the analytics logging being in use so that records exist. Publicly available exploit code exists via the WPScan advisory; the impact is confined to telemetry disclosure with no integrity or availability effect, giving a moderate CVSS score of 5.3.
Unauthenticated information disclosure in the MAIO WordPress plugin before version 7.3.22 allows any remote attacker to retrieve the plugin's stored crawl-analytics log - including each recorded visitor's IP address, user agent, and referer - by presenting a credential value that ships verbatim in the plugin's own publicly distributed source as a valid API key. Because the accepted key is readable by anyone who downloads the plugin, there is effectively no authentication barrier: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and no non-default configuration is required beyond the analytics logging being in use so that records exist. Publicly available exploit code exists via the WPScan advisory; the impact is confined to telemetry disclosure with no integrity or availability effect, giving a moderate CVSS score of 5.3.