Burst Statistics Flaw Exposes 200K WordPress Sites

A critical vulnerability, known as the Burst Statistics flaw, has compromised over 200,000 websites by allowing attackers to bypass authentication and take control of accounts. The flaw, identified by Wordfence’s PRISM platform on May 8, 2026, impacts the Burst Statistics plugin used for privacy-focused analytics on WordPress sites. This vulnerability, tracked as CVE-2026-8181 with a CVSS score of 9.8, allows attackers to impersonate administrator accounts without authentication by exploiting errors in the plugin’s MainWP integration. Within 15 days of discovery, a patch was released on May 12, 2026, to address the issue. Wordfence began notifying users promptly, providing advanced protection for premium subscribers. Experts strongly advise immediate updates to version 3.4.2 and enhanced monitoring of user activities to mitigate potential risks from this Burst Statistics flaw. For comprehensive details, consider reading the full article at the following link:

Critical WordPress Plugin Vulnerability Exposes Websites to Authentication Bypass Attacks