# CVE-2026-8181: Burst Statistics – Privacy-Friendly WordPress Analytics - Authentication Bypass

> Live exploitation tracking for CVE-2026-8181 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-8181

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Burstbv Burst Statistics - Privacy-Friendly WordPress Analytics
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** wordpress, cms

## Description

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

## CrowdSec analysis

[CVE-2026-8181](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-8181) is a critical authentication bypass vulnerability in the Burst Statistics – Privacy-Friendly WordPress Analytics plugin, affecting versions 3.4.0 to 3.4.1.1. Due to improper handling of authentication checks, unauthenticated attackers who know an administrator's username can impersonate that administrator by providing any password, leading to privilege escalation. This flaw could allow attackers to gain full administrative access to the WordPress site, potentially resulting in data theft, site defacement, or further compromise of the web server.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-8181 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2026-8181 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the authentication bypass by sending crafted requests to endpoints under `/wp-json/wp/v2/users` with a manipulated `Authorization` header and `X-BURSTMAINWP: 1`, allowing them to impersonate administrators if a valid username is known.

## Timeline

- 2026-05-14: CVE Published. CVE-2026-8181 is published to NVD.
- 2026-06-03: Rule Released. CrowdSec releases a rule to detect CVE-2026-8181 exploitation attempts against the CrowdSec Network.
- 2026-06-04: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-8181 for the first time.

## References

- https://github.com/Burst-Statistics/burst-statistics/blob/2488d3fa54045e7e5342b0445b9f6b5eaac9ea7c/includes/Frontend/class-mainwp-proxy.php#L385
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8181.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-8181) follows observed exploitation activity for CVE-2026-8181. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.