CVE-2026-8181

The repository contains obfuscated Python code using PyArmor, a legitimate obfuscation tool, but the actual exploit logic for CVE-2026-8181 is entirely hidden. The `finder.py` script is a legitimate scanner for the Burst Statistics WordPress plugin, but the main exploit script (`CVE-2026-8181.py`) and supporting modules are obfuscated with no visible technical details or exploit code, strongly indicating malicious intent.

This repository provides a detailed technical analysis of CVE-2026-8181, an authentication bypass vulnerability in the Burst Statistics WordPress plugin. It includes root cause analysis, exploitation details, and mitigation strategies, but does not contain functional exploit code.

The repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0 to 3.4.1.1). The PoC automates version detection, user enumeration, and privilege escalation by exploiting a logic flaw in the `is_mainwp_authenticated()` function.

This repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0-3.4.1.1). The exploit leverages a flaw in the `is_mainwp_authenticated()` function, allowing unauthenticated attackers to gain admin privileges via crafted HTTP headers.

The repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in Burst Statistics (3.4.0-3.4.1.1) that allows unauthenticated attackers to mint WordPress Application Passwords for admin accounts via a flawed `is_mainwp_authenticated()` check.

This repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in the Burst Statistics WordPress plugin. The exploit allows unauthenticated attackers to impersonate an administrator by using a crafted Basic Authentication header, enabling the creation of a new administrator account.

This repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in Burst Statistics WordPress plugin versions 3.4.0-3.4.1.1. The exploit leverages a flaw in the `is_mainwp_authenticated()` function to bypass authentication and gain admin privileges via crafted HTTP headers.

This repository contains a functional exploit for CVE-2026-8181, an authentication bypass vulnerability in Burst Statistics WordPress plugin versions 3.4.0 to 3.4.1.1. The exploit leverages incorrect return-value handling in the `is_mainwp_authenticated()` function to impersonate admin users and achieve full account takeover.

This repository contains a functional exploit PoC for CVE-2026-8181, an authentication bypass vulnerability in the Burst Statistics WordPress plugin. The PoC demonstrates the vulnerability by sending a crafted request with a fake Basic Authentication password and the 'X-BurstMainWP: 1' header, which bypasses authentication in vulnerable versions.

This repository contains a functional Python exploit for CVE-2026-8181, which leverages an authentication bypass in Burst Statistics (WordPress plugin) to create a new administrator account. The exploit forges Basic authentication headers and sends a crafted POST request to the WordPress REST API.

This repository contains a functional exploit for CVE-2026-8181, targeting a WordPress REST API authentication bypass vulnerability. The exploit automates username enumeration, bypass testing, application password extraction, and admin user creation.

This repository contains a functional Python exploit for CVE-2026-8181, an authentication bypass vulnerability in Burst Statistics WordPress Plugin versions 3.4.0-3.4.1.1. The exploit leverages a flaw in the `is_mainwp_authenticated()` method to bypass authentication and gain admin privileges.

This repository contains a functional Python exploit for CVE-2026-8181, an authentication bypass vulnerability in Burst Statistics WordPress plugin versions 3.4.0-3.4.1.1. The exploit leverages a flaw in the `is_mainwp_authenticated()` method to gain admin privileges without valid credentials.