Security alert: CVE-2026-8181 allows WordPress administrators to take control via Burst Statistics (200,000 sites at risk)

A critical failure in the Burst Statistics plugin (CVE-2026-8181) is being exploited to get access with administrator privileges on WordPress, which turns sites that use this plugin into full-control take-over targets. Burst Statistics, promoted as a light and privacy-friendly alternative to Google Analytics and with a presence in around 200,000 facilities, introduced the vulnerable code in version 3.4.0 and it also remained in 3.4.1.

The technical origin of the problem lies in the way the plugin validates credentials through the internal WordPress function wp _ authenticate _ application _ password (). The Burst Statistics code interprets error responses (WP _ Error) and null values as if they were valid authentication and then runs wp _ set _ current _ user () with the user name provided by the attacker, which allows to supplant any known administrator during the execution of REST API requests.

This is not theory: the WordPress REST API includes sensitive endpoints such as / wp-json / wp / v2 / users and the basic authentication manipulated by the failure allows an attacker to supply any password and still pass through the indicated administrator. User names of administrators are usually presented in comments, entries or public requests, and when they are not available they can be guessed by gross force, which simplifies the attacker's work.

The practical consequences are severe: with privileges admin an attacker can create fraudulent administrative accounts, inject back doors into files and database, distribute malware, redirect traffic, insert malicious SEO content or steal confidential data. Wordfence researchers have confirmed malicious activity in nature and report massive blockages of exploitative attempts; their public follow-up documents the ongoing campaign and recommends updating or disabling the plugin immediately. More technical details and alerts are available in the Wordfence note: Wordfence - Burst Statistics and in his threat tracker: Wordfence Threat Intel.

The immediate and non-negotiable measure for affected managers is to update to the parched version 3.4.2 published on 12 May 2026 or, if it is not possible to update immediately, disable the plugin until applying the patch. The WordPress statistics accompanying the publication show tens of thousands of facilities that already downloaded the corrected version, but there are still many potentially exposed sites: the plugin page in the official repository documents the download information and versions: Burst Statistics - WordPress.org.

If there is the least suspicion that your site was compromised, act as if it was compromised: put the website in maintenance or at restricted access level, review the user list from the panel and through the database to detect new or unknown administrative accounts and address them, inspect files and directories for backdoors and recent changes, compare with clean backups and consider restoring from a verified previous copy. It is also crucial to rotate credentials from administrators and database passwords, regenerate WordPress keys and salts, and review PHP web access records and login to determine the engagement window.

To reduce future risk, apply hardening measures: limit access to the REST API when it is not necessary, implement authentication of two factors in high-privilege accounts, impose robust passwords and non-trivial user names, remove plugins and no-use issues, and deploy a firewall to the application level or host provider that can block massive operating attempts. The official WordPress hardening guide is a good starting point: Hardening WordPress - WordPress.org.

Finally, document the incident and, if you do not have sufficient internal experience, contact the hosting provider or an incident response team to conduct a forensic analysis, contain and eradicate any persistence. Update right now remains the most effective action to cut the ongoing campaign; postponing the update dramatically increases the likelihood of an intrusion that requires hours of cleaning and potential data loss or reputation.