Burst Statistics WordPress Plugin Authentication Bypass (CVE-2026-8181)

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin, versions 3.4.0 to 3.4.1.1, contains an authentication bypass vulnerability (CVE-2026-8181). Due to incorrect return-value handling in the is_mainwp_authenticated() function, unauthenticated attackers with knowledge of an administrator’s username can impersonate that administrator for the duration of a request. This is achieved by supplying any random password in the Basic Authentication header. This vulnerability allows for privilege escalation and potentially complete control of the WordPress site.

Attack Chain

1. Attacker identifies a valid administrator username on the target WordPress site.
2. Attacker crafts an HTTP request to a WordPress endpoint, such as /wp-admin/options-general.php.
3. Attacker includes an Authorization header in the crafted request using Basic Authentication.
4. Attacker uses the known administrator username as the Basic Authentication username and any arbitrary string as the password.
5. The is_mainwp_authenticated() function incorrectly validates the application password.
6. The plugin authenticates the attacker as the specified administrator.
7. Attacker performs administrative actions due to the elevated privileges.
8. Attacker modifies site settings, installs malicious plugins, or injects malicious code to achieve persistence or further compromise.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to gain administrative access to the WordPress site. This can lead to complete site compromise, including data theft, defacement, malware injection, and denial of service. Given the widespread use of WordPress and the popularity of analytics plugins, a large number of websites could be affected. The CVSS v3.1 base score is 9.8, indicating a critical severity.

Recommendation

• Upgrade the Burst Statistics plugin to a version higher than 3.4.1.1 to patch CVE-2026-8181.
• Deploy the Sigma rule Detect Burst Statistics Authentication Bypass to identify exploitation attempts in web server logs.
• Monitor web server logs for HTTP requests to sensitive WordPress endpoints with an Authorization header using Basic Authentication, as highlighted in the attack chain.