Full Report
Hackers are leveraging a critical authentication bypass vulnerability in the WordPress plugin Burst Statistics to obtain admin-level access to websites. [...]
Analysis Summary
# Vulnerability: Authentication Bypass in Burst Statistics WordPress Plugin
## CVE Details
- **CVE ID:** CVE-2026-8181
- **CVSS Score:** 9.8 (Critical) - *Estimated based on impact description*
- **CWE:** CWE-287 (Improper Authentication) / CWE-288 (Authentication Bypass Using an Alternate Path)
## Affected Systems
- **Products:** Burst Statistics (WordPress Plugin)
- **Versions:** 3.4.0, 3.4.1
- **Configurations:** Sites where a valid administrator username is known or can be guessed.
## Vulnerability Description
The vulnerability arises from an incorrect implementation of the `wp_authenticate_application_password()` function within the plugin's REST API handling. Specifically, the plugin code fails to correctly interpret the results returned by WordPress core authentication functions.
When an attacker provides a valid administrator username but an incorrect password in a Basic Authentication header, the function returns a `WP_Error` or `null`. The plugin logic erroneously treats these non-success returns as a valid authentication signal. Consequently, it executes `wp_set_current_user()` using the provided username, granting the attacker the permissions of that administrator for the duration of the REST API request.
## Exploitation
- **Status:** Exploited in the wild (Active exploitation observed as of May 14, 2026).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Access to private databases, user data, and site configuration).
- **Integrity:** High (Ability to create rogue admin accounts, plant backdoors, and modify site content).
- **Availability:** High (Potential for site takeover or malicious redirects).
## Remediation
### Patches
- **Update to Version 3.4.2** or higher immediately. This version, released on May 12, 2026, contains the official fix for the authentication logic.
### Workarounds
- If patching is not immediately possible, **deactivate and delete** the Burst Statistics plugin to remove the vulnerable entry point.
- Restrict access to the WordPress REST API to trusted IP addresses only, though this may impact site functionality.
## Detection
- **Indicators of Compromise:**
- Unauthorized creation of new administrator accounts.
- Unusual REST API requests targeting `/wp-json/wp/v2/users`.
- Presence of unknown "Basic Authentication" headers in server logs paired with administrative actions.
- **Detection Methods:**
- Use security scanners (e.g., Wordfence, Sucuri) to check for the specific plugin version.
- Review audit logs for `wp_set_current_user` calls occurring without successful password verification.
## References
- [https://www.wordfence.com/blog/2026/05/200000-wordpress-sites-at-risk-from-critical-authentication-bypass-vulnerability-in-burst-statistics-plugin/]
- [https://wordpress.org/plugins/burst-statistics/advanced/]
- [https://www.bleepingcomputer.com/news/security/hackers-exploit-auth-bypass-flaw-in-burst-statistics-wordpress-plugin/]