Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2026-8181 EUVD-2026-30242GHSA-qv3x-rrx4-9pmh

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

Published May 14, 2026 · Updated May 14, 2026 · Assigned by Wordfence

Vendor: burstbv Product: Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) Category: Web / CMS

Description

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

Affected products

VendorProductAffectedFixed
burstbv Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) 3.4.0 – ≤ 3.4.1.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 12 repositories · most starred shown

  • zycoder0day/CVE-2026-8181 ★ 6 · May 14, 2026

    CVE-2026-8181 - Burst Statistics 3.4.0-3.4.1.1 Unauthenticated Authentication Bypass to Admin Account Takeover | Proof of Concept

  • murrez/CVE-2026-8181 ★ 4 · May 15, 2026

    CVE-2026-8181 PoC: Burst Statistics (3.4.0–3.4.1.1) authentication bypass. Python tool — single & multi-target scans, threaded workers, TXT reports. Authorized testing only. Maintainer: mürrez.

  • 0xTerror/CVE-2026-8181 ★ 1 · Aug 20, 2026
  • xShadow-Here/CVE-2026-8181 ★ 1 · May 17, 2026

    CVE-2026-8181 | Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

  • whattheslime/CVE-2026-8181 ★ 1 · May 16, 2026

    Exploit for the CVE-2026-8181 - Burst Statistics WordPress Plugin Authentication Bypass

  • Ez4rd1x1/CVE-2026-8181 ★ 0 · Jun 2, 2026
  • x48ps/CVE-2026-8181 ★ 0 · May 22, 2026

    This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authenticatio…

  • Yucaerin/CVE-2026-8181 ★ 0 · May 22, 2026

    The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass

  • rootdirective-sec/CVE-2026-8181-Lab ★ 0 · May 17, 2026
  • Jenderal92/CVE-2026-8181 ★ 0 · May 16, 2026

    CVE-2026-8181: Burst Statistics Auth Bypass → REST API takeover & admin creation. Python 2.7. Educational use only.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References