WordPress Burst Statistics /wp-json/wp/v2/users/me 权限绕过漏洞（CVE-2026-8181）

2026-05-29 WordPress Burst Statistics PoC No

Description

WordPress Burst Statistics 是一款由 Really Simple Plugins 开发的网站分析插件，用于为 WordPress 网站提供详细的访客统计和数据分析功能。该插件支持实时访客跟踪、页面浏览统计、用户行为分析等核心功能，广泛应用于各类 WordPress 网站的流量分析场景。WordPress Burst Statistics 3.4.0-3.4.2 版本存在权限绕过漏洞，攻击者可通过伪造 X-BURSTMAINWP 请求头绕过身份验证，获取管理员权限。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://nvd.nist.gov/vuln/detail/CVE-2026-8181
https://www.wordfence.com/blog/2026/05/200000-wordpress-sites-at-risk-from-critical-authentication-bypass-vulnerability-in-burst-statistics-plugin/
https://www.sentinelone.com/vulnerability-database/cve-2026-8181/
https://github.com/whattheslime/CVE-2026-8181
https://www.crowdsec.net/vulntracking-report/cve-2026-8181-wordpress-burst-statistics-authentication-bypass
https://www.tenable.com/cve/CVE-2026-8181
https://www.rapid7.com/db/vulnerabilities/burst-statistics-plugin-cve-2026-8181/
https://www.bleepingcomputer.com/news/security/hackers-exploit-auth-bypass-flaw-in-burst-statistics-wordpress-plugin/
https://github.com/murrez/CVE-2026-8181
https://www.cve.org/CVERecord?id=CVE-2026-8181

Description

PoC

References

Related Vulnerabilities