The Burst Statistics plugin contains a flaw in the is_mainwp_authenticated() function, where the return value of the password validation is incorrectly interpreted. An attacker who knows an administrator’s username can send any Basic Authentication password in the Authorization header. The plugin mistakenly accepts the request and treats the attacker as the admin for the request’s duration, allowing full administrative privileges without legitimate credentials. This gives the attacker the ability to perform any action that a site owner can, effectively enabling a temporary admin takeover.

The vulnerability affects WordPress sites running the Burst Statistics – Privacy-Friendly WordPress Analytics plugin, specifically versions 3.4.0 through 3.4.1.1. Any installation of these plugin versions is exposed.

It is inferred that the attack vector is via HTTP requests with a forged Authorization header to the plugin’s endpoint. The flaw carries a CVSS score of 9.8, categorizing it as Critical. The EPSS score is 5%, indicating a moderate probability of exploitation, and it is not currently listed in the CISA KEV catalog, suggesting no publicly documented exploits yet. The attack requires only network access to the site and knowledge of an administrator username, with the password being arbitrary.