Burst Statistics Authentication Bypass Vulnerability (CVE-2026-8181) – Critical Fix Released

Burst Statistics, a WordPress analytics plugin with over 200,000 active installs, was hit by a critical authentication bypass flaw discovered on May 8, 2026. The vulnerability was introduced on April 23, 2026, and allows unauthenticated attackers who know an administrator username to impersonate that admin for the duration of any REST API request by supplying an arbitrary Basic Authentication password. In the worst case, an attacker can create a new administrator account without prior authentication. The affected versions are 3.4.0 through 3.4.1.1, and the vendor released a patch on May 12, 2026, upgrading to 3.4.2. Wordfence Premium, Care, and Response customers received a firewall rule on May 8, while free users received the rule on June 7. The CVE-2026-8181 score is 9.8 (Critical). The rapid patch cycle—one day after disclosure—highlights the effectiveness of AI‑driven vulnerability research.

The patch resolves the flawed return‑value handling in the MainWP integration, ensuring that only valid WP_User objects are accepted and preventing the accidental elevation of privileges. Wordfence’s firewall rule blocks exploit attempts targeting the authentication bypass, and the plugin’s new version removes the vulnerable code path entirely.