Jenderal92/CVE-2026-8181

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that exploits CVE-2026-8181 in the Burst Statistics WordPress plugin. It bypasses REST API authentication using a crafted header, retrieves application passwords, verifies privileged access, and creates a new administrator user on vulnerable targets.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python 2.7 exploit for CVE-2026-8181. It performs authentication bypass, credential retrieval, and admin user creation on vulnerable WordPress sites, all consistent with the described vulnerability. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed. The script writes results to local files (res_login.txt, full_res_login.txt) as documented, with no external exfiltration or hidden actions.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareBurst Statistics WordPress plugin
Attack typesauthentication bypassprivilege escalationaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending crafted requests to bypass authentication, retrieve credentials, and create a new admin user. It does not merely detect the vulnerability; it performs the full attack chain described in the CVE.

CVE-2026-8181.py:199-236README.md:1-3

Requirements

  • Target must be running a vulnerable version of the Burst Statistics plugin (3.4.0 to 3.4.1.1).README.md:9
  • Attacker must know or be able to enumerate an administrator username.CVE-2026-8181.py:41-63

Observed behavior

  • Enumerates a WordPress username via the REST API or author redirects.CVE-2026-8181.py:41-63
  • Sends a crafted request with X-BURSTMAINWP header and Basic auth to test authentication bypass.CVE-2026-8181.py:65-71
  • Retrieves an application password token from the /burst/v1/mainwp-auth endpoint.CVE-2026-8181.py:73-101
  • Verifies privileged access by reading WordPress settings, plugins, and admin users.CVE-2026-8181.py:103-126
  • Creates a new administrator user account via the REST API.CVE-2026-8181.py:128-152
  • Saves obtained credentials to local files (res_login.txt, full_res_login.txt).CVE-2026-8181.py:154-197
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Harvesting
Script retrieves application passwords and creates new admin users on target sites.This is the intended exploit behavior for CVE-2026-8181, not a backdoor.CVE-2026-8181.py:73-101CVE-2026-8181.py:128-152
Local File Write
Results saved to res_login.txt and full_res_login.txt in the current directory.Documented output behavior; no evidence of remote exfiltration.CVE-2026-8181.py:154-197
Review boundaries

What the analysis did not establish

  • One file (unclassified, 2875 bytes) was omitted from the packet; its content is unknown.
  • The evidence was not executed; classification is based solely on static analysis of the provided source code.
  • One file (metadata-only) was not inspected; it is a non-text file with no content provided, but its metadata shows no executable code.
  • The review does not assess the safety of running the script on a system, only whether the script itself contains backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1