CVE-2026-8181

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

• CWE-287

• https://github.com/Burst-Statistics/burst-statistics/blob/2488d3fa54045e7e5342b0445b9f6b5eaac9ea7c/includes/Frontend/class-mainwp-proxy.php#L385
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L314
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L328
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L336
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Traits/trait-admin-helper.php#L205
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L314
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L328
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L336
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Traits/trait-admin-helper.php#L205
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8175IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 …9.8
• CVE-2026-8176The LatePoint – Calendar Booking Plugin for Appointments and…7.5
• CVE-2026-8177XML::LibXML versions through 2.0210 for Perl read out-of-bou…7.5
• CVE-2026-8178An issue exists in Amazon Redshift JDBC Driver versions prio…9.2
• CVE-2026-8179IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 …8.8
• CVE-2026-8180IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 …7.5
• CVE-2026-8182IBM Langflow OSS 1.0.0 through 1.10.3 installations allow an…8.8
• CVE-2026-8183IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3,…7.7
• CVE-2026-8185A security vulnerability has been detected in UGREEN CM933 1…6.3
• CVE-2026-8186A vulnerability was detected in Open5GS up to 2.7.7. This af…7.5
• CVE-2026-8187A flaw has been found in Open5GS up to 2.7.7. This impacts t…7.5
• CVE-2026-8188A vulnerability has been found in Wavlink NU516U1 M16U1_V240…8.8