CVE-2026-8181

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

• CWE-287

• https://github.com/Burst-Statistics/burst-statistics/blob/2488d3fa54045e7e5342b0445b9f6b5eaac9ea7c/includes/Frontend/class-mainwp-proxy.php#L385
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L314
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L328
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php#L336
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Traits/trait-admin-helper.php#L205
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L314
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L328
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Frontend/class-mainwp-proxy.php#L336
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/includes/Traits/trait-admin-helper.php#L205
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=cve

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81802Unauthenticated Insecure Direct Object References (IDOR) in …6.5
• CVE-2026-81803Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1…7.5
• CVE-2026-81804Unauthenticated Sensitive Data Exposure in ZHBackup – Backup…7.5
• CVE-2026-81805Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 v…8.1
• CVE-2026-81806Server-Side Request Forgery (SSRF) vulnerability in John Dar…7.2
• CVE-2026-81807The Simple Ajax Chat WordPress plugin before 20260827 does …8.8
• CVE-2026-81810The All-in-One WP Migration and Backup WordPress plugin befo…7.2
• CVE-2026-81814Affected versions of Flowintel render calendar event titles …5.1
• CVE-2026-81817Affected versions of Flowintel contain an insecure direct ob…7.2
• CVE-2026-81818Affected versions of Flowintel contain an authorization flaw…8.6
• CVE-2026-81819Affected versions of Flowintel expose the /my_assignment/use…5.3
• CVE-2026-8182IBM Langflow OSS 1.0.0 through 1.10.3 installations allow an…8.8