Authentication Bypass in Burst Statistics WordPress Plugin

This repository is a Python-based exploit toolkit for CVE-2026-8181, an authentication bypass affecting the Burst Statistics WordPress plugin versions 3.4.0 through 3.4.1.1. The core exploit capability is unauthenticated admin-context takeover by sending a crafted request that abuses Burst Statistics' MainWP authentication logic using the X-BURSTMAINWP header and a Basic Authorization header containing a known administrator username with any password. The included cleartext PoC in CVE2.PY describes the bug, supports single-target and multi-target exploitation, formats results, and can optionally create a new administrator account for persistence. Repository structure shows two parallel implementations: an obfuscated main exploit/application set protected with PyArmor (CVE-2026-8181.py and the system/ package), and several readable helper tools. gui_modern.py provides a PyQt5 GUI for scanning and exploitation. finder.py performs target discovery using FOFA, Shodan, manual input, or file-based lists, then validates plugin presence by requesting /wp-content/plugins/burst-statistics/. search_playwright.py automates Google dorking via Playwright, and dolkings.py performs simpler Google searches using the googlesearch library. run.bat is a Windows launcher that installs dependencies and starts the GUI, falling back to the CLI exploit. Notable fingerprintable endpoints include the plugin path /wp-content/plugins/burst-statistics/, version-check files /wp-content/plugins/burst-statistics/readme.txt and /wp-content/plugins/burst-statistics/burst.php, the WordPress admin path /wp-admin/, FOFA API endpoint https://fofa.info/api/v1/search/all, and Google search at https://www.google.com/search?q=. The repository also contains a .google-cookie file with Google cookie data, indicating browser-assisted search automation. Overall, this is not just a detector: it is a functional exploit suite with scanning, target acquisition, GUI orchestration, and post-bypass account takeover capability.

This repository is a small standalone Python proof-of-concept for CVE-2026-8181 affecting the Burst Statistics WordPress plugin. The repository contains three files: a MIT LICENSE, a README with vulnerability description and usage, and a single executable script, PoC.py, which is the core exploit. PoC.py implements a full exploit chain rather than mere detection. First, check_plugin_ver() requests /wp-content/plugins/burst-statistics/readme.txt and parses the Stable tag to confirm the plugin version. evaluate_ver() then restricts execution to versions 3.4.0, 3.4.1, and 3.4.1.1. Next, enum_user() queries /wp-json/wp/v2/users to harvest public usernames from the WordPress REST API. exploit_validation() either auto-selects the only discovered user or prompts the operator to choose one from multiple usernames. The exploitation step occurs in main(). The script constructs a Basic Authorization header using the selected valid username and a hardcoded arbitrary password ("RandomPassword"), adds the custom header X-Burstmainwp: 1, and sends a POST request to /wp-json/wp/v2/users?context=create with attacker-controlled username, password, and email. The JSON body explicitly requests roles: ["administrator"], so successful exploitation results in creation of a new administrator account. This is a remote unauthenticated web exploit that abuses flawed authentication logic in the target plugin to impersonate an administrator without knowing the real password. Notable operational characteristics: the script disables TLS certificate warnings and uses verify=False for requests, making it tolerant of self-signed HTTPS targets. It depends on the requests library and standard Python modules only. There is no shell payload, malware behavior, persistence mechanism, or post-exploitation automation beyond account creation. Overall, this is an operational exploit PoC for privilege escalation and site takeover on vulnerable WordPress installations running the affected Burst Statistics plugin.

Repository contains two standalone Python exploit scripts for CVE-2026-8181 affecting the Burst Statistics WordPress plugin, plus a plugin fingerprint dork, a large target list, and a minimal README. The exploit purpose is unauthenticated admin takeover by abusing the plugin's MainWP authentication logic before WordPress REST API dispatch. Both scripts describe the same core issue: a crafted request with the X-BURSTMAINWP header and Basic Authorization can cause wp_set_current_user() to run as an administrator for the entire request, enabling privileged REST API operations such as user creation. Structure: README.md only names the CVE; Dork.txt contains a search fingerprint for locating sites exposing /wp-content/plugins/burst-statistics/; list.txt is a large bulk target list of domains/IPs; exploit.py is a more aggressive mass-exploitation utility with multithreading, randomized usernames/passwords/user-agents, interactive and batch modes, and local result files user.txt, token.txt, and new-user-and-header.txt; main.py is a cleaner PoC/operational script supporting single-target and multi-target modes, optional admin-user creation, combined or per-host output, SSL verification control, and threaded execution. Capabilities: identify or assume an admin username, send crafted authentication-bypass requests, operate against single or multiple WordPress targets, and create a new administrator account or otherwise leverage admin REST access. The repository is not just detection logic; it is an operational exploit set with credential/output handling and bulk-target support. The included target list indicates intended mass exploitation rather than limited proof-of-concept testing.

Repository contains a README and one Python exploit script. The script is a standalone operational exploit for CVE-2026-8181 affecting the WordPress Burst Statistics plugin versions 3.4.0 through 3.4.1.1. Its purpose is to exploit an authentication bypass in the plugin's MainWP-related logic to obtain a WordPress Application Password for a known administrator account, resulting in persistent admin takeover. Structure: README.md documents the vulnerability, affected versions, exploitation concept, impact, CLI usage, and remediation. exploit_burst_statistics.py is the main executable entry point and implements the attack workflow. Exploit capabilities observed in code: it creates a requests session, disables TLS verification warnings, performs version detection against common WordPress plugin paths, supports verbose logging, single-target exploitation, and multithreaded mass scanning from a target list. The script is designed to work over HTTP(S) against remote WordPress sites. Based on the README and visible code, the exploit flow is: detect plugin version, identify or accept a known admin username, send crafted requests using the X-BurstMainWP: 1 header plus Basic Auth, trigger the vulnerable authentication path, and retrieve an application password token for the admin account. It then prints the token and attempts to decode/display the resulting application password when exploitation succeeds. Fingerprintable endpoints directly visible in the code are limited to local target-relative paths used for reconnaissance: /wp-content/plugins/burst-statistics/readme.txt, /wp-content/plugins/burst-statistics/burst-statistics.php, and /. The README additionally describes the vulnerable REST route /burst/v1/mainwp-auth and the required header X-BurstMainWP: 1, which are central to exploitation, but the visible truncated code excerpt does not show the exact request construction lines. Overall, this is a real exploit rather than a detector-only script. It does not merely check exposure; it aims to obtain working administrator credentials in the form of a WordPress Application Password, making it an operational account-takeover tool.

Repository contains two Python utilities and a README describing CVE-2026-8181 affecting the WordPress Burst Statistics plugin. The main exploit is create.py, a standalone Python script that targets WordPress REST API endpoints. It first checks whether the target appears to be WordPress, then queries /wp/v2/users to enumerate usernames, builds bypass headers using X-BURSTMAINWP: 1 and Basic authentication with a known admin username plus a fake password, and uses the vulnerable REST API flow to create a new administrator account. Successful runs save the target wp-admin URL and generated credentials to an output file. The script supports multiple targets from a file, optional insecure SSL mode, configurable timeout, and uses requests/colorama/pyfiglet for HTTP and console output. The secondary utility, scan.py, is a threaded mass scanner/detector rather than an exploit. It normalizes domains, probes both HTTPS and HTTP, and fetches /wp-content/plugins/burst-statistics/readme.txt to extract the plugin Stable tag. It flags versions 3.4.0, 3.4.1, and 3.4.1.1 as vulnerable and writes findings to wp-vuln.txt. This provides target discovery for the exploit script. Overall purpose: identify WordPress sites running vulnerable Burst Statistics versions and exploit an unauthenticated admin impersonation flaw to create a persistent administrator account. The repository is small, focused, and operational rather than framework-based.

Repository contains 5 files: two Python programs (exploit.py and main.py), a minimal README, a dork/fingerprint file, and a large target list. This is not a framework module; it is a standalone mass-exploitation toolkit for CVE-2026-8181 affecting the WordPress Burst Statistics plugin. The exploit logic described in both Python files targets an authentication bypass in the plugin's MainWP-related authentication path, using the custom header X-BURSTMAINWP and a crafted Basic Authorization header to coerce WordPress into treating the request as an administrator before REST API dispatch. The stated impact is full admin takeover for the request, with follow-on actions such as enumerating users and creating a new administrator account. exploit.py appears to be the more aggressive/operator-focused script: it includes colored console output, random username/password/domain generation helpers, multithreading, interactive and batch modes, and output managers that write successful compromises to user.txt, token.txt, and new-user-and-header.txt. Its banner and comments explicitly advertise admin takeover and mass scanning. main.py is a cleaner PoC/utility implementation with argparse-based single-target and multi-target modes, optional insecure SSL handling, optional admin-user creation, combined/per-host output handling, and formatted result reporting including the target's /wp-admin/ login URL. Both scripts are designed for active exploitation rather than mere detection. Dork.txt contains a search fingerprint for locating WordPress sites exposing /wp-content/plugins/burst-statistics/. list.txt contains a large set of candidate target URLs and IP-based hosts intended for mass scanning/exploitation. Overall, the repository's purpose is to identify potentially vulnerable WordPress sites running Burst Statistics 3.4.0-3.4.1.1 and exploit the auth bypass to obtain administrator access, often by creating a persistent new admin account and saving the resulting credentials locally.

Repository contains a README and a single Python exploit script, shadow.py, which is the main entry point. The project targets CVE-2026-8181 in the WordPress Burst Statistics plugin (versions 3.4.0 through 3.4.1.1). The README describes an authentication bypass caused by incorrect handling of wp_authenticate_application_password() return values in the plugin’s MainWP authentication flow, allowing attacker-controlled impersonation of an administrator early in request processing. The Python script is an operational exploitation tool rather than a simple detector. It supports single-target mode, file-based mass scanning, and an interactive mode. It uses argparse for CLI handling, requests/urllib3 for HTTP(S) communication, ThreadPoolExecutor for concurrent scanning, and local output helpers to record successful compromises. The script includes randomized usernames/passwords/domains and rotating User-Agent strings, indicating an attempt to automate exploitation at scale. Based on the README and visible code structure, the exploit workflow is: detect WordPress, identify Burst Statistics version, probe the /burst/v1/mainwp-auth route, enumerate likely usernames (or accept a supplied username), attempt the bypass using Basic Authorization plus X-BURSTMAINWP, then leverage elevated WordPress REST API access to enumerate users and create a new administrator account. It also advertises fallback behavior such as admin password reset and takeover verification via wp-login.php. Output is written to user.txt, token.txt, and new-user-and-header.txt. Overall purpose: automated unauthenticated admin takeover of vulnerable WordPress sites running the affected Burst Statistics plugin, with both reconnaissance and post-bypass account-compromise capabilities.

This repository is a self-contained Docker lab and proof-of-concept for CVE-2026-8181, an authentication bypass in the WordPress plugin Burst Statistics – Privacy-Friendly WordPress Analytics. The repo contains 7 files: a README, docker-compose.yml, two Dockerfiles (vuln/ and patched/), a Python PoC (poc/poc.py), and a Bash seeding script (scripts/seed-wordpress.sh). The Docker environment builds two WordPress 6.8.1 instances backed by separate MySQL containers: one with Burst Statistics 3.4.1.1 (vulnerable) and one with 3.4.2 (patched). A one-shot seed container installs WordPress, creates an administrator account named labadmin, and activates the plugin in both environments. The main exploit logic is in poc/poc.py. It is a least-harm, read-only web exploit PoC that targets the WordPress REST API endpoint /?rest_route=/wp/v2/users/me&context=edit. The script first performs a baseline unauthenticated request, then retries with the header X-BurstMainWP: 1 and a forged Basic Authorization header containing a known administrator username and an intentionally incorrect password. On vulnerable targets, the plugin's MainWP proxy authentication path incorrectly treats a non-error result from wp_authenticate_application_password() as sufficient, then calls wp_set_current_user() for the supplied username. This causes the REST request to execute in the context of that user, allowing the PoC to retrieve the admin user's profile and roles. On patched targets, the same request is rejected because the plugin now requires an actual WP_User object. Exploit capability is limited to proving request-scoped impersonation of a known administrator account; it does not create users, upload files, execute commands, or persist changes. The PoC includes a localhost-only safety guard via SAFE_HOSTS = {127.0.0.1, localhost, ::1}, requiring --allow-non-local to target anything else. Overall, this is a legitimate proof-of-concept exploit repository rather than a framework module or mere detector: it demonstrates the vulnerable behavior directly, but in a constrained and non-destructive way.

Repository contains a standalone Python proof-of-concept exploit and a companion Nuclei detection template for CVE-2026-8181 affecting the Burst Statistics WordPress plugin. The main exploit file, CVE-2026-8181.py, uses httpx to send a crafted POST request to WordPress REST API user-creation endpoints. It sets the X-BurstMainWP header and a forged Basic Authorization header containing a known administrator username plus a fake password, exploiting the plugin's flawed MainWP authentication logic to impersonate that administrator for the duration of the request. The JSON payload creates a new persistent administrator account with attacker-supplied or randomly generated credentials. The script supports proxying, custom headers, timeout control, verbosity, and log output, making it a usable operational exploit rather than a simple detection check. The Nuclei template, CVE-2026-8181.yaml, is only for detection/fingerprinting: it checks for plugin presence via homepage asset references and confirms vulnerable versions by reading /wp-content/plugins/burst-statistics/readme.txt and comparing the extracted version to 3.4.0-3.4.1.1. Repository structure is minimal: one Python exploit, one YAML detector, README documentation with root-cause analysis and usage guidance, requirements.txt for dependencies, plus license and gitignore. Overall purpose is to demonstrate and operationalize unauthenticated web exploitation of vulnerable WordPress sites to achieve administrator account takeover via creation of a new admin user.

Repository contains two Python 2.7 scripts and a README. The main exploit, CVE-2026-8181.py, is a multithreaded WordPress web exploit targeting the Burst Statistics plugin authentication bypass identified as CVE-2026-8181. It accepts a target list, normalizes targets by adding a protocol, and tests common WordPress install paths ('/', '/wordpress', '/wp'). It first enumerates a username using either the public REST users endpoint or author-ID redirects. It then attempts the bypass by sending 'X-BURSTMAINWP: 1' plus a crafted Basic Authorization header to '/wp-json/wp/v2/users/me?context=edit'. On success, it calls '/wp-json/burst/v1/mainwp-auth' to obtain an application-password token, checks access to sensitive REST endpoints such as settings, plugins, and administrator-user listings, and finally creates a new administrator account through POST '/wp-json/wp/v2/users'. Successful results, including created credentials and any recovered application password, are appended to 'res.txt'. The secondary script, scanner.py, is a detection utility rather than the main exploit. It checks '/wp-content/plugins/burst-statistics/readme.txt' across the same common base paths, extracts the plugin version, and flags versions 3.4.0, 3.4.1, and 3.4.1.1 as vulnerable, saving matching domains to 'vuln.txt'. Overall, this is a real exploit repository, not just a README or detector. Its primary capability is unauthorized administrative compromise of vulnerable WordPress sites via REST API auth bypass, with follow-on actions including credential/token recovery and persistent admin account creation.

Repository contains a single Python exploit script and a README. The main file, CVE-2026-8181.py, is an operational proof-of-concept for exploiting an authentication bypass in the Burst Statistics WordPress plugin (versions 3.4.0 through 3.4.1.1). According to the embedded documentation, the bug is in the plugin's MainWP authentication logic: a null return from wp_authenticate_application_password() is mishandled, allowing authentication to succeed based only on a supplied username. Because the plugin sets the current user during plugins_loaded, the exploit gains admin privileges for the entire HTTP request before REST route handling. The script is designed for both single-target and multi-target operation. It accepts a single URL (-u) or a file of targets (-f), supports concurrent execution with a thread pool (-j), optional insecure TLS mode (-k), configurable timeout, and text output either as one combined file or per-host files. The default targeted username is 'admin', but it can be changed with -U. The reporting helper formats output including username, password, email, user ID, and a derived /wp-admin/ login address. Core exploit capability is unauthenticated admin-context access via crafted HTTP headers, specifically X-BURSTMAINWP: 1 plus a Basic Authorization header containing a chosen username and arbitrary password. The README and script comments state that once the bypass succeeds, the attacker can access WordPress REST endpoints with full admin context. An optional --create-user mode escalates this into persistent compromise by creating a new administrator account with randomized credentials, which are then written to the report. This makes the repository more than a detector: it is an exploit with post-exploitation account creation capability. No external exploit framework is used; this is a standalone Python script relying primarily on requests/urllib3. The README is extensive and bilingual, documenting the vulnerability, attack chain, usage examples, and operational notes. Overall, the repository's purpose is to automate exploitation of CVE-2026-8181 against vulnerable WordPress sites and optionally establish persistence through creation of a new admin user.

Repository contains a single Python proof-of-concept exploit script and a README. The main file, CVE-2026-8181.py, targets CVE-2026-8181 in the Burst Statistics WordPress plugin (versions 3.4.0 through 3.4.1.1). The exploit is not framework-based and is a standalone operational PoC. The exploit’s core capability is unauthenticated administrator impersonation via a crafted REST request. It builds requests to WordPress REST API endpoints using either /wp-json<route> or the fallback /?rest_route=<route>. To trigger the vulnerable code path, it sends the X-BURSTMAINWP: 1 header plus a forged Basic Authorization header containing a known or guessed admin username and an arbitrary password string. According to the embedded documentation, the plugin incorrectly treats a null return from wp_authenticate_application_password() as non-error on HTTP sites, then resolves the user by username and sets the current user context, granting admin privileges for the request before REST route handling. The script structure includes helper methods for URL construction, REST requests, bypass-header generation, WordPress detection, and exploitation flow. Although the provided content is truncated, the visible logic and README indicate the script can: verify WordPress presence, attempt the auth bypass, retrieve an application password, and optionally create a new administrator account. This makes it more than a detector; it performs post-bypass administrative actions. Fingerprintable targets and artifacts include the WordPress REST API paths (/wp-json and /?rest_route=), the required exploit header X-BURSTMAINWP: 1, and the forged Basic Auth pattern. The README also documents relevant WordPress artifacts for detection and remediation, including wp_users, wp_options, wp_application_passwords, and burst_mainwp_app_token_*. Overall, this repository is a focused exploit PoC for remote web exploitation of vulnerable WordPress sites running the Burst Statistics plugin under conditions where application passwords are unavailable, especially HTTP deployments. Its purpose is account takeover and administrative control, not merely vulnerability detection.