CVE-2026-8181: Authentication Bypass in Burst Statistics Plugin

The impact of this vulnerability is severe. An unauthenticated attacker, possessing knowledge of an administrator's username, can bypass authentication by providing any arbitrary Basic Authentication password. This effectively allows them to act as that administrator for the duration of a single request. This can lead to unauthorized access to sensitive data, modification of website content, installation of malicious code, and ultimately, complete compromise of the WordPress site. The attacker could potentially exfiltrate user data, modify configurations, or even use the compromised site as a launching point for further attacks against other systems on the network.

1. Veröffentlicht2026-05-13

The primary mitigation is to immediately upgrade the Burst Statistics plugin to version 3.4.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct workaround isn't available, implementing a Web Application Firewall (WAF) with rules to block suspicious Basic Authentication attempts can provide a temporary layer of protection. Regularly review WordPress user accounts and permissions to ensure no unauthorized accounts exist. After upgrading, confirm the fix by attempting to access the plugin's administrative interface with an invalid Basic Authentication password; access should be denied.