Critical WordPress Plugin Flaw Exposes 200,000+ Sites to Full Account Takeover A severe authentication bypass vulnerability in the Burst Statistics WordPress plugin tracked as CVE-2026-8181 (CVSS 9.8) has left over 200,000 websites vulnerable to unauthenticated administrator account takeovers. Discovered on May 8, 2026, by Wordfence’s AI-driven PRISM threat intelligence platform, the flaw affects versions 3.4.0 through 3.4.1.1, introduced on April 23, 2026. The vulnerability stems from improper validation in the plugin’s MainWP integration, specifically within the `is_mainwp_authenticated()` function. The function processes authentication requests via the HTTP Authorization header but fails to verify credential validity, allowing attackers to exploit a logic flaw where null responses from WordPress’s `wp_authenticate_application_password()` function are treated as successful authentication. Exploitation requires only a crafted REST API request with a valid administrator username and an arbitrary password encoded in a Basic Authentication header. Once authenticated, attackers gain full administrative privileges, enabling actions such as creating new admin accounts, modifying site content, or executing arbitrary code. The flaw’s impact extends beyond the plugin, as it affects all REST API endpoints, broadening the attack surface. The Burst Statistics team released a patch (version 3.4.2) on May 12, 2026, just 19 days after the vulnerability’s introduction a rapid response attributed to AI-driven detection. Wordfence provided firewall protection to Premium, Care, and Response tier customers on May 8, with free users receiving updates on June 7, 2026. Security experts warn that the low complexity of exploitation and lack of required authentication make this flaw a prime target for threat actors. Administrators are urged to update immediately, audit user accounts, and review logs for signs of compromise.