Once the current user is switched to an administrator, subsequent capability checks pass. The attacker can then reach the /burst/v1/mainwp-auth REST endpoint, which creates a WordPress Application Password for the admin account and returns it in the response. This gives the attacker persistent, full admin-level access.

Affected Plugin

What Attackers Can Do

Technical Analysis

Plugin Initialization and the Vulnerable Gate

Burst Statistics initializes during WordPress's plugins_loaded hook at priority 9, inside class-burst.php:

has_admin_access() is the gatekeeper for all admin functionality. It checks for the X-BurstMainWP header and calls into the vulnerable function:

The Vulnerable Function: is_mainwp_authenticated()

Why wp_authenticate_application_password() Returns null

WordPress internal function wp_authenticate_application_password() has a filter:

When called outside the REST API authentication flow, this returns null. The Burst Statistics code only checked is_wp_error($is_valid) — null is not a WP_Error, so the check incorrectly passes.

Execution Path to Admin Takeover

1. Attacker sends X-BurstMainWP: 1 header with any request
2. has_admin_access() triggers is_mainwp_authenticated()
3. wp_authenticate_application_password() returns null (not in API context)
4. is_wp_error(null) = false → check passes
5. wp_set_current_user($admin_id) executes
6. Current user is now the chosen administrator
7. Attacker POSTs to /burst/v1/mainwp-auth
8. handle_auth_request() mints a WordPress Application Password
9. Token returned as base64(username:app_password)
10. Attacker uses this token for persistent admin REST API access

Patch Analysis (3.4.2)

Fixes applied:

• Force application_password_is_api_request filter to true so actual password validation occurs
• Check that the result is a WP_User instance (not null)
• Use hash_equals() to verify username match

Additionally, the check_auth_permission() for the REST endpoint was hardened to require current_user_can('manage_burst_statistics') and explicit nonce verification for cookie-authenticated requests.

Proof of Concept

Manual cURL

Python Exploit Tool

The exploit_burst_statistics.py script automates the full attack chain:

• Phase 0: Version detection via readme.txt, plugin header, or asset query strings
• Phase 1: Admin username enumeration via REST API, author pages, or common username list
• Phase 2: Auth bypass with X-BurstMainWP: 1 + fake Basic Auth to mint token
• Phase 3: Token verification and structure validation
• Mass Scanner: Threaded multi-target scanning with real-time vulnerable target logging

Exploit Features

• Unauthenticated — no prior access required
• Single HTTP request to mint persistent Application Password
• Auto-detects Burst Statistics version and skips patched targets
• Auto-enumerates admin username if not provided
• Supports both pretty permalinks (/wp-json/) and ugly permalinks (/?rest_route=)
• Mass scanning with ThreadPoolExecutor
• Real-time file write — vulnerable targets saved immediately without waiting for scan completion
• Thread-safe file locking

Usage

Single Target (Auto-Enumerate Admin)

Single Target (Known Admin Username)

Mass Scan

Create targets.txt:

Options

Fix Recommendations

For developers and site owners:

1. Update immediately to Burst Statistics 3.4.2 or later
2. If unable to update, temporarily disable the plugin
3. After updating, revoke all existing Application Passwords for admin accounts:
   • WP Admin → Users → [Admin] → Application Passwords → Revoke All
4. Check for unauthorized admin accounts or unexpected user creation
5. Review server logs for requests containing X-BurstMainWP: 1 header

Timeline

Researcher

• Credit: Chloe Chamberland — Wordfence PRISM

References

• Wordfence Advisory
• CVE Record
• Patch Diff — class-mainwp-proxy.php
• NVD

Disclaimer

This information is provided for educational and authorized penetration testing purposes only. Unauthorized exploitation of computer systems is illegal and unethical. Always obtain explicit written permission before testing any target you do not own.