VDB
CVE-2026-8181
CVE-2026-8181
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
EPSS 3.01% · 87.3th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.01%
87.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| burstbv | Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) | 3.4.0 |
Timeline
- May 14, 2026 VulnCheck KEV Exploitation
- May 14, 2026 CVE Published
- May 14, 2026 CVE Updated
- May 14, 2026 VulnCheck XDB Entry
- May 14, 2026 PoC Published
- May 14, 2026 PoC Published
- May 14, 2026 PoC Published
- May 15, 2026 PoC Published
- May 15, 2026 VulnCheck XDB Entry
- May 15, 2026 Security Advisory
- May 16, 2026 EPSS Score
- May 16, 2026 VulnCheck XDB Entry
References
- Nuclei Template exploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve url
- https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L336 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L336 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L328 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L328 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L314 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L314 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Traits/trait-admin-helper.php#L205 url
- https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Traits/trait-admin-helper.php#L205 url
- https://github.com/Burst-Statistics/burst-statistics/blob/2488d3fa54045e7e5342b0445b9f6b5eaac9ea7c/includes/Frontend/class-mainwp-proxy.php#L385 url
- https://nvd.nist.gov/vuln/detail/CVE-2026-8181 advisory