Piwik (now Matomo) vulnerabilities
We track 1 vulnerability in Piwik (now Matomo) products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2025.
1vulnerabilities
1critical
0high
0exploited
9.4average CVSS score
Latest Piwik (now Matomo) vulnerabilities
- 9.4 Critical severity
Web Analytics Platform: Missing Authentication for Critical Functionality
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP a