CVE-2026-8181

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 14.61%
EPSS Percentile: 96.65%
CISA KEV: Not listed

Description

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-May-2026 13:16
Last Modified: 17-Jun-2026 18:03
EPSS Date: 2026-11-02
CWE: CWE-287

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 03-Nov-2026 11:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Exploited —Threat actors are exploiting a critical flaw in the Burst Statistics WordPress plugin (CVE-2026-8181, CVSS score: 9.8), which “allows unauthenticated attackers who know a valid administrator username to Weekly Cybersecurity Recap: Exchange and Cisco Flaws Exploited, npm Worm Spreads
Hackers are exploiting CVE-2026-8181 in the Burst Statistics WordPress plugin to bypass authentication and gain admin-level access on affected sites. Attackers Exploit Burst Statistics WordPress Plugin Flaw to Gain Admin Access

CVE (3)

Malware (5)

Threat Actors (4)

MITRE ATT&CK (4)

Vendors (9)

Products (9)

Tools (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.