The MAIO WordPress plugin releases crawl‑analytics logs—including IP addresses, user agents, and referers—to anyone who supplies the hardcoded API key embedded in the plugin’s public source code. This flaw allows unauthenticated users to obtain sensitive visitor information, potentially enabling profiling or further attacks. The weakness stems from improper handling of authentication credentials and insufficient access control. In terms of severity, the CVSS score of 5.3 denotes a moderate risk.

Plugins developers and site administrators running MAIO WordPress plugin versions prior to 7.3.22 are impacted. The vulnerability applies to all installations of the plugin in which the hardcoded API key remains unchanged. No specific hosts or operating systems are limited by the description.

With the CVSS of 5.3, this issue carries moderate risk. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but because the vulnerability is publicly exploitable via a simple HTTP request, it is realistic for opportunistic attackers. The KEV catalog lists it as not yet included, indicating no known mass exploitation. Attackers need only make an unauthenticated request to the analytics endpoint, supplying the known API key, to receive the full log of visits such that any logged user can glean privacy‑sensitive data.