Junglewise Threat Intelligence

CVE-2026-8181: Burst Statistics WordPress plugin authentication bypass in is_mainwp_authenticated

CVE-2026-8181 · Severity: critical · CVSS 9.8 · Published 2026-05-14

Executive brief

A vulnerability in the Burst Statistics WordPress plugin allows unauthorized individuals to gain full administrative access to a website. By knowing only an administrator's username, an attacker can bypass security checks and impersonate that user. This could lead to a complete takeover of the website, data theft, or the installation of malicious software.

Technical details

The Burst Statistics plugin for WordPress (versions 3.4.0 to 3.4.1.1) contains an authentication bypass vulnerability due to improper return-value handling in the `is_mainwp_authenticated()` function. When validating application passwords via the Authorization header, the function fails to correctly verify the credentials. An unauthenticated attacker with knowledge of a valid administrator username can exploit this by providing any arbitrary password in a Basic Authentication header. This allows the attacker to impersonate the administrator for the duration of the request, leading to privilege escalation and potential full site compromise.

Affected products

  • Burst Statistics Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) 3.4.0 - 3.4.1.1

Timeline

  • 2026-05-14: disclosed: NVD publication date

References