Burst Statistics – Privacy-Friendly WordPress Analytics - Authentication Bypass (CVE-2026-8181)

CVE-2026-8181 is a critical authentication bypass vulnerability in the Burst Statistics – Privacy-Friendly WordPress Analytics plugin, affecting versions 3.4.0 to 3.4.1.1. Due to improper handling of authentication checks, unauthenticated attackers who know an administrator's username can impersonate that administrator by providing any password, leading to privilege escalation. This flaw could allow attackers to gain full administrative access to the WordPress site, potentially resulting in data theft, site defacement, or further compromise of the web server.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-8181 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2026-8181 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the authentication bypass by sending crafted requests to endpoints under /wp-json/wp/v2/users with a manipulated Authorization header and X-BURSTMAINWP: 1, allowing them to impersonate administrators if a valid username is known.