The Burst Statistics – Privacy-Friendly WordPress Analytics

CVE-2026-8181 is an authentication bypass in the Burst Statistics WordPress plugin affecting versions 3.4.0 through 3.4.1.1, fixed in 3.4.2. The flaw sits in the plugin’s MainWP-related REST authentication path: if a request carries the X-BurstMainWP: 1 header and a Basic Auth username for a valid admin, the plugin can treat a failed application-password check as success and call wp_set_current_user() for that administrator for the life of the request.

The vendor’s 9.8 CRITICAL rating is basically fair here. Yes, the reachable population is narrowed to sites running this specific plugin, but once that condition is true the rest of the chain is thin: attacker position is unauthenticated remote, there is no user interaction, the only meaningful prerequisite is knowing an admin username, and real-world WordPress deployments often leak or guess that easily enough. Add active exploitation telemetry and this stays in the top bucket.

Why this verdict

• Baseline stays high: vendor 9.8 starts from the right place because attacker position is *unauthenticated remote* and successful exploitation yields effective administrator control.
• Prerequisite audit only trims a little: the main narrowing factor is install base—only sites running Burst Statistics 3.4.0–3.4.1.1 are exposed—so this is not a universal WordPress emergency.
• Username knowledge is weak friction: needing one valid admin username sounds meaningful on paper, but in practice WordPress usernames are often enumerable or guessable, especially on public marketing sites and small agency-managed estates.
• No prior compromise stage required: there is no internal-network, authenticated-user, or privileged-role prerequisite. That keeps this out of the 'post-initial-access' bucket and prevents a downgrade.
• Modern controls may help but are uneven: a tuned WAF can block the header/auth pattern, and Wordfence users got protection early, but many sites will not have those controls deployed or tuned before scanning starts.
• Exploitation evidence is the amplifier: public reporting of live attack traffic means this has moved from theoretical bug to operational takeover path.

Why not higher?

There is some real-world narrowing: only sites running a specific plugin release line are affected, and exploitation still needs a valid admin username. This is not the kind of ubiquitous infrastructure bug that instantly lights up every edge scanner on the internet. 9.7 instead of a hard 10 reflects that bounded population.

Why not lower?

A downgrade would require meaningful chain friction such as authentication, internal-only reachability, unusual configuration, or a requirement for an already-compromised user role. None of that applies here. If the plugin is present and vulnerable, this is an internet-reachable path to admin takeover with observed abuse.

1. Block X-BurstMainWP from the public internet — At the WAF, reverse proxy, or web server layer, deny requests carrying X-BurstMainWP: 1 unless they originate from explicitly trusted management infrastructure. Because exploitation evidence exists, deploy this immediately, within hours as a temporary barrier while patching catches up.
2. Patch Burst Statistics to 3.4.2+ — This is the actual fix for the broken auth logic. For actively exploited internet-facing sites, do it immediately, within hours; for the broader fleet, this still falls under the noisgate remediation SLA of ≤90 days because the verdict remains CRITICAL.
3. Disable the plugin where unused — If a site does not need Burst Statistics, deactivating and removing it collapses the attack surface faster than waiting on normal change windows. Because attackers are already probing, unused instances should be disabled within hours.
4. Alert on REST user creation — Instrument web, WordPress, and SIEM telemetry for POST /wp-json/wp/v2/users, unexpected administrator creation, and admin actions from previously unseen source IPs. Stand this up within hours for exposed sites because post-exploit persistence is typically a rogue admin account.
5. Constrain WordPress user enumeration — Reduce easy admin-username harvesting by limiting public REST user exposure and author enumeration where business impact allows. This is a secondary control, not the fix, but it raises attacker cost and should be applied within hours on externally exposed sites if patching will lag.

Run this on the target WordPress host or inside the container/VM that holds the site files. Invoke it as bash check-burst-cve-2026-8181.sh /var/www/html/wp-content/plugins/burst-statistics; it needs only read access to the plugin directory, not root, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-burst-cve-2026-8181.sh
# Detects whether the local Burst Statistics WordPress plugin version is affected by CVE-2026-8181.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

set -u

PLUGIN_DIR="${1:-}"

if [[ -z "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wp-content/plugins/burst-statistics"
  exit 2
fi

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - directory not found: $PLUGIN_DIR"
  exit 2
fi

PLUGIN_FILE=""
for f in "$PLUGIN_DIR"/burst-statistics.php "$PLUGIN_DIR"/*.php; do
  if [[ -f "$f" ]]; then
    if grep -qiE '^\s*Plugin Name:\s*Burst Statistics' "$f" 2>/dev/null; then
      PLUGIN_FILE="$f"
      break
    fi
  fi
done

if [[ -z "$PLUGIN_FILE" ]]; then
  # Fall back to the canonical file name even if the header is missing.
  if [[ -f "$PLUGIN_DIR/burst-statistics.php" ]]; then
    PLUGIN_FILE="$PLUGIN_DIR/burst-statistics.php"
  else
    echo "UNKNOWN - could not locate plugin main file"
    exit 2
  fi
fi

VERSION=$(awk -F': ' 'BEGIN{IGNORECASE=1} /^\s*Version:/ {gsub(/\r/,"",$2); print $2; exit}' "$PLUGIN_FILE")

if [[ -z "$VERSION" && -f "$PLUGIN_DIR/readme.txt" ]]; then
  VERSION=$(awk -F': ' 'BEGIN{IGNORECASE=1} /^\s*Stable tag:/ {gsub(/\r/,"",$2); print $2; exit}' "$PLUGIN_DIR/readme.txt")
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - version not found in plugin headers or readme"
  exit 2
fi

verlte() {
  [[ "$1" == "$2" ]] && return 0
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

verlt() {
  [[ "$1" != "$2" ]] && verlte "$1" "$2"
}

# Vulnerable range: 3.4.0 <= version <= 3.4.1.1
if verlte "3.4.0" "$VERSION" && verlte "$VERSION" "3.4.1.1"; then
  echo "VULNERABLE - Burst Statistics version $VERSION is in affected range 3.4.0-3.4.1.1"
  exit 1
fi

if verlt "$VERSION" "3.4.0" || verlt "3.4.1.1" "$VERSION"; then
  echo "PATCHED - Burst Statistics version $VERSION is outside affected range"
  exit 0
fi

echo "UNKNOWN - parsed version '$VERSION' could not be classified"
exit 2

Sources

1. Wordfence technical advisory
2. Wordfence vulnerability database entry
3. WordPress.org plugin page and changelog
4. NVD record
5. BleepingComputer exploitation report
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS API documentation
8. Tenable web-app plugin 115244