WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...

conn-burst

Connection Burst Identification This package identifies "bursting connections" which are considered to be connections which transfer a large amount of data quickly. Once a bursty connection is identified it is no longer watched for being bursty. When a bursty connection is identified, the event...

CVE-2026-23918

CVE-2026-23918 Apache modhttp2 Double-Free Detector https://github.com/user-attachments/assets/d6c30e58-548c-4b6d-9ba3-baa667238a58 python3 h2ghost.py -h usage: h2ghost.py -h --host HOST --port PORT --tls --no-tls --iterations ITERATIONS --burst-n BURSTN --timeout TIMEOUT --crash-threshold...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authentication Bypass to Admin Account Takeover Vulnerability Summary The WordPress plugin Burst Statistics versions 3.4.0 to 3.4.1.1 is vulnerable to an unauthenticated authentication bypass vulnerability that leads to full administrator account...

CVE-2026-8181

CVE-2026-8181 exploit Burst Statistics WordPress Plugin — Authentication Bypass to Administrator Privilege Escalation Exploit for the CVE-2026-8181 discovered by Chloe Chamberland and PRISM. ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2026-8181-Lab

CVE-2026-8181 — Burst Statistics Authentication Bypass Lab Local-only Docker lab for CVE-2026-8181 , an authentication bypass in the WordPress plugin Burst Statistics – Privacy-Friendly WordPress Analytics. This lab compares a vulnerable plugin version against the patched version and uses a...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Burst Statistics Authentication Bypass -brightgreen.svg?style=for-the-badge !CAUTION CRITICAL ALERT: This vulnerability allows an unauthenticated remote attacker to bypass authentication and gain full Administrator privileges on the target WordPress site by simply injecting a...

CVE-2026-8181

CVE-2026-8181 Proof of Concept Research • Validation • Security Testing "roses a red, violet are blue, i think i just shat my pant thinking about you. rizz" CVE Overview Field| Value ---|--- CVE ID| CVE-2026-8181 Type| Authentication Bypass Impact| Privilege Escalation / Full Site Takeover Attack...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-8181 Plugin| Burst Statistics – Privacy-Friendly WordPress Analytics Affected Versions| 3.4.0 – 3.4.1.1 Patched Version| 3.4.2 CVSS Score| 9.8 Critica...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2026-8181

| Authentication Required 💥 CVE-2026-8181 - Burst Statistics Authentication Bypass Unauthenticated Privilege Escalation via MainWP Authentication Bypass 👨‍💻 Author !0xTerrorhttps://assets.kitploit.com/production/public/readmes/50604/f036bd5517ab1ec023381e336e314b53384b618d5a934600f6128...

CVE-2026-8181

EN: Controlled PoC and brief technical notes for authorized security testing of the authentication bypass in Burst Statistics. TR:...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from raw to noinc for FIFO regmap functions The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is set to $00, allowing all FIFO data to be read without needing...

CVE-2026-75084

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

PT-2026-114280

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get packet length and validates it in verify rxfifo validity drivers/ieee802154/ieee802154 cc1200.c. That validation only enforced a lower bound pkt len data and then calls net buf ad...

CVE-2026-98277

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-97343

The Burst Statistics – Simple WordPress Analytics Google Analytics Alternative plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard handler issuing a genuine WordPress...