CVE-2026-8181

Name of the Vulnerable Software and Affected Versions Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) versions 3.4.0 through 3.4.1.1

Description An authentication bypass exists due to incorrect return-value handling in the is mainwp authenticated() function when validating application passwords from the Authorization header. Unauthenticated attackers with knowledge of an administrator username can impersonate that administrator for the duration of the request by providing any random Basic Authentication password, leading to privilege escalation and remote code execution (RCE). Over 200,000 sites have been affected, with more than 7,400 attacks recorded within 24 hours of disclosure.

Recommendations Update to version 3.4.2.