Authentication Bypass Vulnerability in Burst Statistics Plugin for WordPress

CVE-2026-8181

What is CVE-2026-8181?

The Burst Statistics plugin for WordPress contains a security flaw that allows unauthenticated attackers to exploit incorrect handling of return values in the authentication process. This leads to a vulnerability in the is_mainwp_authenticated() function, enabling attackers who know an administrator's username to impersonate that user during a request by using any arbitrary Basic Authentication password. As a result, this poses a significant threat to the security and integrity of WordPress sites using this plugin, as it can lead to unauthorized access and potential privilege escalation.

References