tldrdailynews.com logo

Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover

1 min read
Source: CyberSecurityNews
Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover
Photo: CyberSecurityNews
TL;DR

A critical vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0–3.4.1.1, CVE-2026-8181) allows unauthenticated attackers to bypass authentication and impersonate an administrator via crafted REST API requests, potentially creating a new admin account and taking over a site. Discovered May 8, 2026 by Wordfence’s PRISM, it was patched in version 3.4.2 on May 12, 2026. The flaw stems from improper handling of authentication in the MainWP integration, enabling exploitation across REST endpoints. admins should immediate patch to 3.4.2+, audit user accounts, and monitor logs to prevent compromise.

Topics:technologycybersecurity#authentication-bypass#burst-statistics#cve-2026-8181#cybersecurity#vulnerability#wordpress
Share this article
  1. Critical Wordpress Plugin Vulnerability Exposes Websites to Authentication Bypass Attacks  CyberSecurityNews
  2. Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin  BleepingComputer
  3. 1 Million WordPress Websites Exposed by Avada Builder Security Vulnerabilities  gbhackers.com
  4. Critical vulnerability in Burst Statistics plugin allows admin takeover | brief | SC Media  SC Media
  5. Burst Statistics WordPress flaw under attack  Bitdefender

Want the full story? Read the original reporting

Read on CyberSecurityNews