Loading vulnerability…
Administrator Authentication Bypass in WordPress Burst Statistics
CVE-2026-8181 is an authentication bypass vulnerability in the Burst Statistics – Privacy-Friendly WordPress Analytics plugin for WordPress, affecting versions 3.4.0 through 3.4.1.1. The MainWP integration's is_mainwp_authenticated() function incorrectly handles the return value of wp_authenticate_application_password(). When application-password authentication returns null rather than a WP_Error object, the plugin treats the credentials as valid and calls wp_set_current_user() for the supplied username. An unauthenticated attacker who knows an administrator username can submit an arbitrary Basic Authentication password and impersonate that administrator for the duration of the request. The resulting privileges extend to WordPress REST API functionality beyond the plugin's own endpoints. Active exploitation has been observed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants administrator-level access to WordPress REST API functionality for the crafted request. Attackers can create additional administrator accounts, modify website content, and install plugins, potentially enabling persistent website takeover. Potential consequences include sensitive data theft, defacement, malware distribution, and malicious redirection.
If you can’t patch tonight, do this now.
Disable Burst Statistics if an immediate update is not possible. Deploy the available Wordfence firewall rule for this vulnerability as an interim control. Review logs for requests containing the X-BurstMainWP: 1 header and suspicious administrator-account creation activity.
Patch, then assume compromise.
Upgrade Burst Statistics to version 3.4.2 or later, the fixed version consistently identified in the patch guidance. One account instead recommends version 3.4.1.2 or later; the minimum fixed version is therefore inconsistently stated, and version 3.4.2 or later is the conservative update target. Review administrator accounts, particularly those created on or after May 13, 2026, and remove unauthorized accounts. Review request logs for evidence of exploitation.
12 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.