PT-2026-40880 · WordPress · Burst Statistics

Chloe Chamberland + 1 · Published 2026-05-14 · Updated 2026-06-08 · CVE-2026-8181

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Burst Statistics versions 3.4.0 through 3.4.1.1

Description The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress contains an authentication bypass flaw. The issue stems from incorrect return-value handling in the is mainwp authenticated() function when validating application passwords from the Authorization header. This allows an unauthenticated attacker who knows an administrator username to impersonate that administrator for the duration of a request by providing any random Basic Authentication password, leading to privilege escalation and full site takeover. Over 200,000 sites are estimated to be affected worldwide, with more than 7,400 attacks recorded within 24 hours of disclosure.

Recommendations Update Burst Statistics to version 3.4.2. Audit administrator accounts for any unrecognized users created during the period of exposure. Enable automatic updates for plugins to reduce the window of exposure for future issues.

Fix

LPE

RCE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-8181

Affected Products

Burst Statistics

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2026-8181 · Security Note
• https://github.com/Burst-Statistics/burst-statistics/blob/2488d3fa54045e7e5342b0445b9f6b5eaac9ea7c/includes/Frontend/class-mainwp-proxy.php#L385 · Note
• https://calmbit.net/ffc/wordpress-privacy-plugin · Reddit Post
• https://twitter.com/UndercodeNews/status/2055112113991860323 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Traits/trait-admin-helper.php#L205 · Note
• https://twitter.com/KaitanSecurity/status/2054811457590628655 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2061871182467514521 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2055076288654651821 · Twitter Post
• https://twitter.com/SirajD_Official/status/2061674287682158788 · Twitter Post
• https://twitter.com/OrizonCyber/status/2054811479828734111 · Twitter Post
• https://twitter.com/TechTranslators/status/2055032887976624581 · Twitter Post
• https://t.me/true_secator/8211 · Telegram Post
• https://t.me/CVEtracker/53751 · Telegram Post
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L328 · Note