Burst Statistics: authentication bypass to admin accounts (CVE-2026-8181)

An attacker who knows an administrator username can use an invalid WordPress Application Password to impersonate that administrator for the request on affected Burst Statistics versions.

Public CVE record · Vendor advisory or update instructions · Module source · Source and API bundle · CNA advisory

Patch title. Burst Statistics Privileged Request Guard (burst-statistics-privileged-request-guard in the registry). The original source snapshot preserves the source available for the historical report.

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

Synthetic HTTP controls

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/wp-json/burst",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The rule checks for the presence of X-Burst-Auth on POST, PUT and DELETE under /wp-json/burst.

const ROUTE: &[u8] = b"/wp-json/burst";

Implement the remediation

Vendor update. Update Burst Statistics through WordPress to a maintained release at least as recent as 3.4.2.1. The vendor documents direct credential validation in 3.4.2.1. On staging, confirm invalid application passwords are refused and authorized MainWP calls still work if you use the integration. Vendor instructions.

The published package uses registry name burst-statistics-privileged-request-guard. Verify its own archive digest before import. Use the fixture API example to reproduce the recorded comparison. It covers the declaration, signed module activation, verification, revocation, and restoration.

Fixture and probes

The benign probe tracked analytics presenting the auth binding. The marked probe deleted a goal without any binding. The fixture incremented its marker when an unbound privileged operation reached the plugin.

Measured comparison (2026-11-14 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Test scope

The rule checks for the presence of X-Burst-Auth on POST, PUT and DELETE under /wp-json/burst. It did not validate a WordPress Application Password or reproduce the vendor’s Basic Authentication bypass.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 225e70a50749606ac2e8399980aed88aad8e433da6592484e008a6208cf82ff5
• Tested binary SHA-256 b0ba872eb3c99d4db8394d877cc795c78997ee4f47af580176fa457f70c8eac7
• Activation operation 23239f49-3274-48d5-9336-e7029f09c8ea

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Evidence and artifacts

• Public CVE record
• Published module source
• Source and API bundle