Attackers Exploit Burst Statistics WordPress Plugin Flaw to Gain Admin Access
Summary
Attackers are exploiting CVE-2026-8181, an authentication-bypass flaw in Burst Statistics versions 3.4.0 and 3.4.1. Wordfence reports blocking more than 7,400 attacks; users should update to 3.4.2 or disable the plugin.
Key points
- The flaw lets unauthenticated attackers impersonate known administrators during REST API requests and potentially create rogue admin accounts.
- Wordfence says the bug stems from mishandling authentication-function results, treating error or null values as successful authentication.
- The vulnerability was introduced in version 3.4.0 and also affected version 3.4.1.
- Wordfence reports blocking more than 7,400 attacks targeting the flaw in 24 hours.
- Users should upgrade to version 3.4.2, released May 12, 2026, or disable the plugin.
- The article estimates roughly 115,000 sites may remain exposed, assuming all 85,000 downloads since the fix were for version 3.4.2.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical
- Affected Versions
- Burst Statistics 3.4.0
- Burst Statistics 3.4.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade to version 3.4.2.
- Disable the plugin.
MITRE ATT&CK
CVE
Products
Burst StatisticsHackers are exploiting CVE-2026-8181 in the Burst Statistics WordPress plugin to bypass authentication and gain admin-level access on affected sites.WordPressHackers are exploiting CVE-2026-8181 in the Burst Statistics WordPress plugin to bypass authentication and gain admin-level access on affected sites.