DavidV.TV ® Christ RAW 101 @DavidVTV@tastingtraffic.net

🛡️ WebTrafficCops 🚔

*Recommends #Matomo, formerly #Piwik, is a #free and #open_source web #analytics application to #track online #visits to one or more websites and display #reports on these visits for #analysis.

🚨 #Burst_Statistics 🚨

#Wordfence | #Wordpress
2 hours ago

200,000 WordPress Sites at #Risk from Critical #Authentication #Bypass #Vulnerability in #Burst_Statistics #Plugin

On May 8, 2026, PRISM, Wordfence Threat Intelligence's autonomous vulnerability research platform, discovered a critical Authentication Bypass vulnerability in Burst Statistics, a WordPress plugin with more than 200,000 active installations.

This vulnerability allows unauthenticated attackers who know a valid administrator username to fully impersonate that administrator for the duration of any REST API request, enabling actions such as creating new administrator accounts with no prior authentication.

Vulnerability Details:

- CVE ID: CVE-2026-8181
- CVSS Score: 9.8 (Critical)
- Vulnerability Type: Authentication Bypass to Admin Account Takeover
- Affected Versions: 3.4.0 - 3.4.1.1
- Patched Version: 3.4.2

Unfortunately, insecure return-value handling in the plugin's MainWP integration allows unauthenticated attackers to impersonate any administrator for the lifetime of a REST API request.

The Burst Statistics plugin includes a proxy integration with the MainWP site management platform.

This integration implements a custom HTTP authentication scheme.

The critical flaw lies in the is_mainwp_authenticated() function.

This function treats any non-WP_Error return from wp_authenticate_application_password() as successful authentication.

WordPress core may return null when Application Passwords are not in use.

Since null is not a WP_Error, the plugin's guard silently passes even though no password validation occurred.

This allows an attacker who knows a valid admin username to send a single HTTP request with a fake password to any REST endpoint.

From there, they can create a new administrator account with no real credentials.

Researcher Credit:

This vulnerability was discovered by Chloe Chamberland and PRISM, Wordfence Threat Intelligence's autonomous vulnerability research platform.

Wordfence Protection:

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 8, 2026.

Sites using the free version of Wordfence will receive the same protection 30 days later, on June 7, 2026.

Read the full report:

https://www.wordfence.com/blog/2026/0...

📛 DISCLAIMER: We Cover the 'Way' the #News is #COVERED_UP! 👿

BOOK AN APPT: https://tastingtrafficsupportchat.as.me/schedule/4053988b

Please consider a PAYPAL USD OR MONERO XMR gift of [ $50 USD ] or any XMR EQUIVALENT amount that feels right? #Gifts can be sent online using your
favorite #Monero, #Cake, #Feather Wallets by selecting the MONERO PUBLIC KEY BELOW.

#PayPal_Donation: Coming out of 10 Years #Self_Funded. #Donations will be used to Cover Monthly Operating Expenses.
May you and your Family Be Blessed. Thankyou for your Consideration.

https://www.paypal.com/donate?hosted_button_id=RQQEQPBBD69DQ

monero:42m12GQEWioFmMgYFdqcPpCvqDNiCCyq5D6QUk5VDmS4CitHM6ZK5XULU44hpEyDZrcMB2KfETTyJfmf4S2Rni5Z5kCZ54s

Welcome to the Future of Advertising

DavidV: 25 YEARS 24/7 Experience:

* Software Architect (PhD) Supervisor -25 years 300K PMS (project management) hours
* EXPERT BLACK BOX TESTER (1999)
* Founder of WebTafficCops.com the 1ST Dedicated CLICK FRAUD ENGINE on the Planet (1999)
* Founder of SEO (Search Engine Optimization, (1999)
* Founder of RTB (Real Time Bidding (1999)
* Founder of HFT (High Frequency Trading 2001)
* Founder of the first Screen Recorder (Applets) on the Planet (2000)
* Founder of DEVSECOPS (2000)
* Founder and CREATOR OF #BULLETPROOF #cryptocurrency FULL PRIVATE NODES via WWW since 2016 and MERCHANT INTEGRATION.

🍷 🍾 #TASTINGTRAFFIC_LLC | The Largest (WWW) #DIGITAL_TRAFFIC PROVIDER in the WORLD since 1999.

🌐 https://tastingtraffic.net/sitemap.xml

TASTINGTRAFFIC_LLC are NOT affiliates of this provider or referenced images used. This is NOT an endorsement OR Sponsored (Paid) Promotion/Reshare.