murrez/cve-2026-8181

CVE-2026-8181 is a proof-of-concept tool written in Python that demonstrates an authentication bypass vulnerability, tracked as CWE-287, in the Burst Statistics WordPress plugin. The flaw affects plugin versions 3.4.0 through 3.4.1.1 and was fixed in version 3.4.2. It allows a remote, unauthenticated attacker to escalate a crafted REST API request to full WordPress admin access by sending specific HTTP headers. The attack combines an X-BURSTMAINWP header with a fake Basic authorization credential, which causes the plugin's authentication check to follow a mis-handled code branch that grants admin-level access. The severity rating given is CVSS around 9.8, considered critical. The script CVE-2026-8181.py is described as lab automation for authorized security testing. It can scan a single target site with a -u flag or a list of targets from a text file with -f. Multiple worker threads can run in parallel using -j. Successful results can be written to one combined output file with -o, or saved as separate per-host files in a directory with output-dir. An optional create-user flag attempts to create a new administrator account through the REST API during a successful bypass, and the generated password is written into the report if that happens. A -k flag disables TLS certificate verification for use in lab environments. The README points out that the plugin's reported 200,000 plus active installs figure is the entire user base of the plugin, not a count of sites running the vulnerable version, so real-world impact depends on which version and environment each site is actually running. The author frames the tool as intended for authorized testing and defensive hardening only, and the README is written in parallel English and Turkish sections throughout.