Brief Summary: CVE-2026-8181 Authentication Bypass in Burst Statistics WordPress Plugin

Introduction

Over 200,000 WordPress sites running the Burst Statistics plugin became vulnerable to full administrator impersonation through a single unauthenticated HTTP request, with confirmed reports of active exploitation in the wild. The flaw, tracked as CVE-2026-8181 with a CVSS score of 9.8, lets an attacker who knows only a valid admin username bypass authentication entirely and use the WordPress REST API as that administrator.

Burst Statistics is a privacy-focused WordPress analytics plugin built as an alternative to Google Analytics. With over 200,000 active installations, it holds a meaningful share of the WordPress analytics plugin market. Its integration with the MainWP site management platform, which is central to this vulnerability, makes it relevant to organizations that manage fleets of WordPress sites.

Technical Information

The root cause of CVE-2026-8181 is a classic return-value mishandling bug in the is_mainwp_authenticated() function within class-mainwp-proxy.php. Burst Statistics includes a proxy integration with the MainWP site management platform, and that integration implements its own HTTP authentication scheme. When an incoming request includes the X-BurstMainWP: 1 header, the plugin hands authentication to this function.

The function reads the Authorization HTTP header, decodes the Base64-encoded Basic credentials, and splits them into a username and password. The credential extraction logic looks like this:

public function is_mainwp_authenticated(): bool {
 $auth_header = sanitize_text_field( wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '' ) );
 if ( ! empty( $auth_header ) && stripos( $auth_header, 'basic ' ) === 0 ) {
 // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
 $credentials = base64_decode( substr( $auth_header, 6 ), true );
 if ( ! $credentials ) {
 return false;
 }
 $parts = explode( ':', $credentials, 2 );
 if ( count( $parts ) !== 2 ) {
 return false;
 }

The function then passes the username and password to the WordPress core function wp_authenticate_application_password(). This is where it goes wrong. The plugin treats any return value other than a WP_Error as a successful authentication.

The Null Return Problem

When Application Passwords are not enabled on a WordPress installation (or in certain other edge cases), wp_authenticate_application_password() returns null rather than a WP_Error object. Because null is not a WP_Error, the plugin's check silently passes. The code then calls wp_set_current_user() with the attacker-supplied username, which makes that user the globally authenticated WordPress user for the entire request.

Cross-Endpoint Impact

Once wp_set_current_user() runs with an administrator's username, every WordPress capability check for the rest of that request sees a fully authenticated administrator. The impersonation reaches every REST API route, WordPress core endpoints as well as the ones Burst Statistics registers. An attacker can, for example, send a POST request to /wp-json/wp/v2/users and create a new administrator account for persistent access.

Step-by-Step Attack Flow

The attacker identifies a valid administrator username on the target WordPress site. Admin usernames are often discoverable through author archive URLs or the WordPress REST API users endpoint.
The attacker crafts an HTTP request with two headers: X-BurstMainWP: 1 and Authorization: Basic <base64(admin_username:any_random_password)>.
The plugin's is_mainwp_authenticated() function intercepts the request, extracts the credentials, and passes them to wp_authenticate_application_password().
On sites where Application Passwords are not enabled, the core function returns null.
The plugin reads null as a non-error condition and treats authentication as successful.
The plugin calls wp_set_current_user() with the attacker-supplied admin username, which grants full administrator privileges for the request.
The attacker can now call any WordPress REST API endpoint as the impersonated administrator, including creating new admin accounts, modifying content, or installing plugins.

The flaw is classified under CWE-287 (Improper Authentication). The label fits, since the plugin grants access without properly validating the authentication outcome.

Affected Systems and Versions

The vulnerability affects the Burst Statistics plugin for WordPress in the following version range:

Vulnerable versions: 3.4.0 through 3.4.1.1
Fixed version: 3.4.2

The vulnerable code arrived on April 23, 2026, with the release of version 3.4.0. Any WordPress installation running Burst Statistics versions 3.4.0, 3.4.1, or 3.4.1.1 is affected. Sites where Application Passwords are not enabled are particularly exposed, because that is the condition that makes wp_authenticate_application_password() return null rather than a WP_Error.

The plugin reports over 200,000 active installations.

CVE Analysis

Experimental AI-Generated Content

Introduction