ez4rd1x1/cve-2026-8181Proof-of-concept exploit for CVE-2026-8181, an authentication bypass in the Burst Statistics WordPress plugin. Demonstrates remote, unauthenticated privilege escalation for authorized security testing and research.
"roses a red, violet are blue, i think i just shat my pant thinking about you. (rizz)"
| Field | Value |
|---|---|
| CVE ID | CVE-2026-8181 |
| Type | Authentication Bypass |
| Impact | Privilege Escalation / Full Site Takeover |
| Attack Vector | Network (Remote, Unauthenticated) |
| CVSS | 9.8 (Critical) |
| Affected Software | Burst Statistics – Privacy-Friendly WordPress Analytics (Plugin versions 3.4.0 to 3.4.1.1) |
CVE-2026-8181 is a security vulnerability identified in Burst Statistics (Wordpress Plugins).
At a high level, the issue occurs when:
A logic flaw in return-value handling within the is_mainwp_authenticated() function fails to properly validate application passwords under HTTP Basic Authentication.
When a request is made using a valid administrator username but an arbitrary/incorrect password, the function misinterprets the validation outcome. Instead of rejecting the failed authentication attempt, the logic incorrectly permits the request to proceed as authenticated
This flaw allows unauthenticated, remote attackers to completely bypass security checks, seamlessly impersonating an administrator account and achieving full privilege escalation without possessing valid credentials.
for more info check out my Write-Up
| Feature | Status |
|---|---|
| Reproducible Exploit Flow | ✔ |
| Safe Research Mode | ✔ |
| Minimal Dependencies | ✔ |
| Defensive Testing Support | ✔ |
git clone https://github.com/Ez4rd1x1/CVE-2026-8181
cd CVE-2026-8181
python3 PoC.py -t <target> -u <new username> -p <new password> -e <new email>
Example:
python3 PoC.py -t https://target.com -u NewSuperAdmin -p NewPasswordSuckerrr!! -e [email protected]
[!IMPORTANT] This project is strictly for educational and authorized security testing.
You may only run this against systems you own or have explicit permission to test.
[!WARNING] Misuse of this tool is not tolerated.
Unauthorized exploitation detected = consequences activated
System response:
- Tracking initialized
- Logs forwarded
- Diddy notification sent
- Party assignment pending
If you’re doing legitimate security research, nothing happens.
If not, you get added to the guest list.
No exceptions.
If you discover additional attack vectors or improvements, follow responsible disclosure practices and notify the affected vendor.
MIT License