External risk intelligence

Burst Statistics WordPress plugin could allow external attackers to gain admin access.

The Burst Statistics WordPress plugin could allow external attackers who know an administrator's username to gain administrative access, potentially exposing sensitive data and allowing for the manipulation of website content or configuration.

NVD published May 14, 2026 (yesterday)

External risk briefCRITICAL

CVE-2026-8181

Halo Surface Signal

4/ 5

This vulnerability affects a WordPress plugin installed on a web application. WordPress sites are overwhelmingly deployed as public-facing websites. The flaw exists in a request-handling component within the plugin, making the attack surface directly reachable to remote, unauthenticated users via the standard internet-facing web interface.

Exposure facts

CVSS

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.26%

H – Horizon Alert

A security vulnerability has been identified in the Burst Statistics – Privacy-Friendly WordPress Analytics plugin. Due to a flaw in how the software verifies credentials, an unauthorized individual with knowledge of an administrator's username could bypass security measures to impersonate that administrator. This presents a potential business concern, as it could allow unauthorized users to gain elevated administrative access within the WordPress environment.

A – Asset Exposure

The Burst Statistics plugin for WordPress is affected, specifically impacting websites that utilize this analytics tool. Since these websites are typically internet-facing, this vulnerability may allow external attackers who possess an administrator's username to gain unauthorized admin access to the site. This potential compromise could jeopardize the security of sensitive data and allow for the unauthorized manipulation of website content or configuration.

L – Live Threat

The available context for this WordPress plugin vulnerability does not indicate active exploitation or observed targeting at this time. While the underlying flaw could theoretically facilitate unauthorized access to administrative privileges if an administrator username is known, there is no evidence of active malicious activity. Consequently, we are not observing specific live-threat signals associated with this vulnerability.

O – Operational Fix

We recommend that your technical team immediately determine if your organization is currently utilizing the Burst Statistics plugin for WordPress. Since a specific resolution is not detailed in the available information, your team should prioritize validating the current deployment and actively monitor the plugin vendor’s official channels for updates. Following the vendor’s direct guidance is the best course of action to ensure your environment remains secure.