What is the CVSS score of CVE-2026-8181?

CVE-2026-8181 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Burst Statistics are affected by CVE-2026-8181?

The Burst Statistics WordPress plugin (versions 3.4.0-3.4.1.1) contains a critical authentication bypass that allows unauthorized remote attackers to gain full administrator access without valid…

Is there a public PoC exploit available for CVE-2026-8181?

Yes, a public proof-of-concept exploit is available for CVE-2026-8181. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-8181?

24 Hours: Identify all WordPress instances running Burst Statistics 3.4.0-3.4.1.1 and immediately disable the plugin; implement emergency network restrictions on WordPress admin interfaces if possible. 7 Days: Conduct security audit of administrator access logs on affected sites for unauthorized activity; implement HTTP Basic Authentication blocking at the firewall or reverse-proxy layer. 30 Days: Monitor vendor advisory channels for security patch release; apply patch immediately upon availability and verify no admin account compromise occurred during the exposure window.

Burst Statistics CVE-2026-8181

EUVD-2026-30242 CRITICAL

Improper Authentication (CWE-287)

2026-05-14 security@wordfence.com

GHSA-qv3x-rrx4-9pmh

Authentication Bypass Google Privilege Escalation WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:21 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Burst Statistics - Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the is_mainwp_authenticated() function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

Articles & Coverage 1

POC CVE-2026-8181: Burst Statistics WordPress Plugin Authentication Bypass Allows Unauthenticated Admin Takeover (CVSS 9.8) May 15, 2026

AnalysisAI

Authentication bypass in the Burst Statistics WordPress plugin versions 3.4.0 through 3.4.1.1 allows unauthenticated remote attackers to impersonate any administrator whose username they know by supplying an arbitrary Basic Authentication password. The flaw resides in flawed return-value handling within the is_mainwp_authenticated() function used to validate application passwords from the Authorization header, enabling privilege escalation per request. No public exploit identified at time of analysis, and EPSS is low (0.26%), but the CVSS 9.8 score and SSVC 'total' technical impact mark it as a high-severity authentication bypass worth prioritizing.

Technical ContextAI

Burst Statistics is a privacy-focused WordPress analytics plugin marketed as a Google Analytics alternative, integrating with the MainWP child-site management framework. The vulnerable code path lives in includes/Frontend/class-mainwp-proxy.php and the is_mainwp_authenticated() helper, which parses the Authorization header for HTTP Basic credentials representing a WordPress application password. The root cause is CWE-287 (Improper Authentication): the function's return value is mishandled so that a failed validation is treated as success, meaning the supplied password is never effectively checked against the stored application-password hash. As a result, presenting a valid administrator username with any arbitrary password produces an authenticated administrator session for the duration of the request, bypassing WordPress's normal password verification entirely.

RemediationAI

No vendor-released fixed version is enumerated in the provided data, so administrators should upgrade Burst Statistics to the latest release published after 3.4.1.1 via the WordPress plugin dashboard and confirm the fix against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve and the upstream repository at https://github.com/Burst-Statistics/burst-statistics. Until a confirmed patched version is installed, deactivate the Burst Statistics plugin (this disables analytics collection but eliminates the vulnerable code path entirely) or, if the MainWP integration is not in use, block external requests to the plugin's MainWP proxy endpoints at the web server or WAF layer - accepting that this will break legitimate MainWP child-site reporting. As a hardening measure, revoke all existing WordPress application passwords for administrator accounts and rename or obscure administrator usernames to raise the bar for attackers attempting to guess a valid admin login, recognizing that WordPress username enumeration mitigations are imperfect and should not be relied on as a sole control.