EUVD-2026-30242
GHSA-qv3x-rrx4-9pmh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Burst Statistics - Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the is_mainwp_authenticated() function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the Burst Statistics WordPress plugin versions 3.4.0 through 3.4.1.1 allows unauthenticated remote attackers to impersonate any administrator whose username they know by supplying an arbitrary Basic Authentication password. The flaw resides in flawed return-value handling within the is_mainwp_authenticated() function used to validate application passwords from the Authorization header, enabling privilege escalation per request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Burst Statistics plugin installed and activated at versions 3.4.0 through 3.4.1.1, and that the attacker knows (or can enumerate) a valid administrator username on the site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) is consistent with the description: network-reachable, no privileges, no user interaction, with full impact on confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an administrator username on a target WordPress site through standard enumeration (REST API `/wp-json/wp/v2/users`, author archives, or login error messages), then sends a single HTTP request to a Burst Statistics MainWP proxy endpoint with an Authorization header containing `Basic base64(admin:anyrandomstring)`. Because `is_mainwp_authenticated()` returns a success-equivalent value regardless of password correctness, the plugin treats the request as coming from that administrator and the attacker performs administrator-level actions for the duration of the request, such as exfiltrating analytics data or chaining into broader site compromise. … |
| Remediation | No vendor-released fixed version is enumerated in the provided data, so administrators should upgrade Burst Statistics to the latest release published after 3.4.1.1 via the WordPress plugin dashboard and confirm the fix against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve and the upstream repository at https://github.com/Burst-Statistics/burst-statistics. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 Hours: Identify all WordPress instances running Burst Statistics 3.4.0-3.4.1.1 and immediately disable the plugin; implement emergency network restrictions on WordPress admin interfaces if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today