CVE-2026-8181: Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the ismainwpauthenticated() function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)to a version that resolves this vulnerability.Fixed in 3.4.1.1 - Compensating control
Mitigate the Authentication Bypass/admin takeover by preventing unauthenticated Basic Auth attempts from reaching the WordPress endpoint that triggers `is_mainwp_authenticated()` (e.g., block/limit Authorization header requests to that path at the network/WAF/ACL level until patched).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8181?
CVE-2026-8181 has a high severity rating due to its potential for authentication bypass, allowing admin account takeover.
How do I fix CVE-2026-8181?
To fix CVE-2026-8181, update the Burst Statistics plugin to version 3.4.1.2 or later.
What versions are affected by CVE-2026-8181?
CVE-2026-8181 affects Burst Statistics plugin versions 3.4.0 to 3.4.1.1.
What type of vulnerability is CVE-2026-8181?
CVE-2026-8181 is an authentication bypass vulnerability that can lead to unauthorized admin access.
How can CVE-2026-8181 impact my WordPress site?
CVE-2026-8181 can allow attackers to take over admin accounts, potentially compromising the entire WordPress site.